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Introduction 


Quantum computing is based on quantum bits or qubits. Unlike traditional computers, in which 
bits must have a value of either zero or one, a qubit can represent a zero, a one, or both values 
simultaneously. Representing information in qubits allows the information to be processed in 
ways that have no equivalent in classical computing, taking advantage of phenomena such as 
quantum tunneling and quantum entanglement. As such, quantum computers may theoretically 
be able to solve certain problems in a few days that would take millions of years on a classical 
computer. 


Quantum computers—a possible future technology that would revolutionize computing by 
harnessing the bizarre properties of quantum bits, or qubits. Qubits are the quantum analogue to 
the classical computer bits “0” and “1.” Engineering materials that can function as qubits is 
technically challenging. Using supercomputers, scientists from the University of Chicago and 
Argonne National Laboratory predicted possible new qubits built out of strained aluminum 
nitride. Moreover, the scientists showed that certain newly developed qubits in silicon carbide 
have unusually long lifetimes. 


Quantum computers could break common cryptography techniques, search huge datasets, and 
simulate quantum systems in a fraction of the time it would take today’s computers. However, 
engineers first need to harness the properties of quantum bits. Engineering new qubits with less 
difficult methods could lower one of the significant barriers to scaling quantum computers from 
small prototypes into larger-scale technologies. 


One of the leading methods for creating qubits involves exploiting specific structural atomic 
defects in diamonds. Using diamonds is both technically challenging and expensive. Now 
researchers from the University of Chicago and Argonne National Laboratory have suggested an 
analogous defect in aluminum nitride, which could reduce the difficulty and ultimate cost of 
manufacturing materials for quantum computing applications. Using the Edison and Mira 
supercomputers at DOE’s National Energy Research Scientific Computing Center and Argonne 
National Laboratory respectively, the researchers found that by applying strain to aluminum 
nitride, they can create structural defects in the material that may be harnessed as qubits similar 
to those seen in diamonds. They performed their calculations using different levels of theory and 
the Quantum Espresso and WEST codes, the latter developed at the University of Chicago. The 
codes allowed them to accurately predict the position of the defect levels in the band-gap of 
semiconductors. The researchers also closely collaborated with experimentalists to understand 


and improve the performance of qubits in industrial materials. Recently, they showed that newly 
developed qubits in silicon carbide have much longer coherence times than that of the more well- 
established defect qubits in diamond. Their results pointed to industrially important polyatomic 
crystals as promising hosts for coherent qubits for scalable quantum devices. 


Source: https://science.energy.gov/ascr/highlights/2017/ascr-2017-01-a/ 


Peter Shor’s 1994 breakthrough discovery of a polynomial time quantum algorithm for integer 
factorization sparked great interest in discovering additional quantum algorithms and developing 
hardware on which to run them. The subsequent research efforts yielded quantum algorithms 
offering speedups for widely varying problems, and several promising hardware platforms for 
quantum computation. These platforms include analog systems (usually cold atoms) used for 
simulating quantum lattice models from condensed-matter and high-energy physics, quantum 
annealers for combinatorial optimization, boson samplers, and small-scale noisy prototypes of 
digital gate-model quantum computers. 


In the longer term, the emergence of scalable, fault-tolerant, digital quantum computers offers a 
new direction for progress in high performance computing as conventional technologies reach 
their fundamental limitations. Quantum speedups have been discovered for a number of areas of 
DOE interest, including simulations for chemistry, nuclear and particle physics, and materials 
science, as well as data analysis and machine learning. In addition, quantum speedups have been 
discovered for basic primitives of applied mathematics such as linear algebra, integration, 
optimization, and graph theory. These demonstrate the potential of quantum computers to yield 
better-scaling methods (in some cases exponentially better) for performing a wide variety of 
scientific computing tasks. Practical realization of this potential will depend not only on 
advances in quantum computing hardware but also advances in optimizing languages and 
compilers to translate these abstract algorithms into concrete sequences of realizable quantum 
gates, and simulators to test and verify these sequences. The development of such software has 
recently seen rapid progress, which can be expected to continue given sufficient support. 


Source: https://science.energy. gov/~/media/ascr/pdf/programdocuments/docs/ASCRQuantumReport-final.pdf 


Imagine typing a very complex query into your computer and having to wait more than a lifetime 
for results. Thanks to scientists like Davide Venturelli, supercomputers of the future could return 
those results in a fraction of a second. Davide is a quantum computer research scientist for the 

Universities Space Research Association. Quantum theory explains how matter acts at the tiniest 


levels; in applying it to computing, researchers study ways in which that behavior can advance 
processing power. “We explore how to control these quantum behaviors, to make them happen 
on demand, in order to crunch numbers and process information,” he says. “We’re pushing the 
boundaries of what is known in computer science.” 


Quantum computer research scientists help to solve problems. In their research, they make 
scientific assumptions based on quantum theory and then conduct experiments to test whether 
their solutions work. These scientists may be involved in a variety of projects but often focus on 
a specific goal. Davide focuses on finding new ways of applying quantum theory to improve how 
computers solve optimization problems—that is, problems for finding the best of all possible 
solutions. Digital computers, which are most common today, process information using variables 
with | value (either 0 or 1) at a time. Quantum computers can use both values simultaneously, 
which results in faster processing. ““We know that quantum computers are more powerful than 
digital computers,” he says, “but we don’t know by how much yet.” 


Research. In studying information technology, quantum computer research scientists think about 
possibilities. For example, Davide asks questions in his research such as, “What is the fastest 
possible way we can make computers process information?” Davide and other research scientists 
use their understanding of quantum theory to come up with solutions. Their research may lead to 
problem-solving computer processes that calculate and sort information much faster. For 
example, research scientists might develop a theoretical solution that can be run only on quantum 
computers designed to produce better weather forecasts. 


Experiments. To test whether their theories work, quantum computer research scientists may 
conduct experiments or work with experimental physicists. For example, they may create a 
quantum environment with computer hardware, then test how particles in that environment react 
to different levels of laser intensity. Experiments that verify a theory may lead to improvements, 
such as more efficient computer design and faster, more secure communication for computer 
networks. But relying on theory means that scientists work with incomplete information—so 
they’re sometimes surprised at the outcomes. “Experiments may result in the opposite of what 
you expect,” says Davide, “and you analyze the data to try to figure out why.” 


To become a quantum computer research scientist, you usually need a doctoral degree (Ph.D.). 
But you need some qualities and skills in addition to the formal credential. As researchers, 
quantum computer research scientists should enjoy being part of a team and sharing their 


findings with others, which may include engineers, mathematicians, physicists, and Ph.D. 
students. This collaboration helps bring varied perspectives to solving a problem. “There’s a 
cross-utilization of ideas when you work with different groups,” Davide says. “My colleagues 
are very smart and open-minded people.” 


Like many scientists, quantum computer research scientists must have strong analytical, critical 
thinking, and reasoning skills to solve complex problems. Attention to detail is critical as 
scientists precisely record their theories and experiments, which must be reproducible and able to 
withstand peer review. 


Communication skills are also important. To share their research with collaborators or the public, 
quantum research scientists must be able to write papers and present their findings at 
conferences. They may also need to write proposals for grants to fund research projects. 
Quantum computer research scientists usually need a Ph.D. to learn methods of discovery and to 
develop the tools needed for researching. Coursework in undergraduate and graduate degree 
programs typically includes computer science, mathematics, and physics. 


You may decide to pursue a master’s degree with classes in quantum computing before entering 
a Ph.D. program. Davide studied physics at the bachelor’s and master’s levels, but he was 
passionate about computers, too. Not surprisingly, quantum computing piqued his interest. “It’s a 
wonderful interaction between the two disciplines,” he says. Davide earned his Ph.D. in 
nanophysics and numerical simulations of condensed matter. 


The U.S. Bureau of Labor Statistics (BLS) does not collect data specifically on quantum 
computer research scientists. Instead, BLS may count these workers among physicists, of which 
15,650 were employed in May 2015. The median annual wage for physicists in colleges, 
universities, and professional schools—where most quantum computer research scientists are 
likely to work—was $63,840. That’s more than the median annual wage of $36,200 for all 
workers. 


Quantum computer research scientists work primarily indoors, in academic settings, and may 
travel frequently to attend seminars or conferences. Area of focus or project type may dictate 
specific details of their work. For example, testing particularly intricate theories may take days or 
months, working either independently or with other scientists. 


Whether alone or with colleagues, Davide enjoys his work for the independence his job offers. 
“You have lots of intellectual freedom. Nobody really tells you what to do,” he says. “It’s up to 
your skills and vision.” 


Source: Domingo Angeles, "Quantum computer research scientist," Career Outlook, U.S. Bureau of Labor Statistics, 
July 2016. https://www.bls.gov/careeroutlook/2016/youre-a-what/quantum-computer-research-scientist.htm 


Realizing the Potential of Quantum Information Science and Advancing High- 
Performance Computing 


July 26, 2016 at 6:07 PM ET by Altaf H. (Tof) Carim, William T. (Tim) Polk, and Erin Szulman 


The Administration reports on challenges, opportunities, and the path forward in quantum 
information science, and releases a plan for high-performance computing. 


Quantum mechanics describes the behavior and interaction of matter and energy at the scale of 
individual atoms or subatomic particles. We intuitively understand the collective effects of 
particles at much larger scales, but quantum behavior can often seem strange and 
counterintuitive. For example, at the most fundamental level, both matter and radiation 
(including visible light) behave in some ways like discrete particles and in other ways like 
continuous waves, resulting in surprising properties. These quantum phenomena include 
superposition (in which a system simultaneously includes all possible measurement outcomes 
with some probability, and only has a fixed value once such a measurement takes place) and 
entanglement (a superposition of the states of multiple particles, in which their properties are 
correlated with each other). Taking advantage of such properties to process information— 
working at the intersection of quantum phenomena with information science—provides unique 
and exciting opportunities in sensing, metrology, navigation, communications, fundamental 
physics, simulation, new paradigms in computing, and a host of other areas. These exciting 
prospects are summarized in a new report from the National Science and Technology Council 
(NSTC), Advancing Quantum Information Science: National Challenges and Opportunities. 


The NSTC report being issued today is the product of an interagency working group that was 
created to assess the current status of the field, coordinate activities across the relevant Federal 
agencies, engage stakeholders, and consider ways to address impediments and facilitate progress 
in quantum information science (QIS). Efforts to date have included internal discussions, 
agency-led and interagency workshops, and public requests for information; working group 
efforts will continue to include both Federal activity and outreach to the relevant research, 
development, and related communities in support of the broad ecosystem needed to realize the 
promise of quantum information science. 


As acomplement to the interagency report, the Department of Energy (DOE) is also publishing 
today the report of a recent roundtable on Quantum Sensors at the Intersections of Fundamental 
Science, Quantum Information Science, and Computing. The roundtable report provides a 
perspective from experts in the research community on promising scientific directions, needs for 


additional progress, and potential approaches consistent with the DOE mission. Other agencies 
have also held workshops and undertaken other activities reflecting the growing attention to QIS, 
including the recent launch of a cross-cutting National Science Foundation “metaprogram” on 
Connections in Quantum Information Science that complements and coordinates several existing 
programs within specific disciplines. 


In addition to having strong connections to other related science and technology initiatives, there 
is significant synergy between the QIS effort and the National Strategic Computing Initiative 
(NSCI). The NSCI is a whole-of-Nation effort, created by Executive Order on July 29, 2015, to 
ensure continued U.S. leadership in high-performance computing (HPC) and to maximize the 
benefits of HPC for the economy and scientific discovery. 


One key NSCI strategic objective is to establish, over the next 15 years, a viable path forward for 
future HPC systems. The NSCI pursues this objective through two concurrent paths: 
technologies that accelerate traditional digital computing after the limits of current 
semiconductor technologies are reached; and a range of new computing paradigms—including 
quantum computing—to address problems beyond the scope of traditional high performance 
computing. Some promising options on both NSCI paths depend on QIS. Understanding and 
controlling quantum effects will be critical to further miniatur-ization of charge-based 
complementary metal oxide semiconductor (CMOS) devices, and to refining alternatives for 
digital computing such as spin-based CMOS or superconducting computing. Basic and applied 
QIS research and development is also needed to clarify the range of computational problems a 
potential quantum computer could address, and to resolve the many challenges to fielding a 
practical quantum computer. 


Today, OSTP is also publishing the National Strategic Computing Initiative (NSCI) Strategic 
Plan, authored by the NSCI Executive Council. Realizing the vision of the NSCI will demand a 
fully developed HPC ecosystem that meets the needs of government, industry, and academia. 
This Strategic Plan (Plan) focuses on areas where government engagement is essential in 
creating the technological capability, computational foundations, and workforce capacity to 
realize the vision of the NSCI. The Plan identifies the roles assigned to Federal agencies, and 
highlights ongoing and prospective activities that will contribute to NSCI’s goals. A combination 
of broad commercial drivers and government action is necessary to achieve the vision of the 
NSCI, but the success of the initiative depends upon deeper collaboration among the Federal 
Government, industry, and academia in the development, commercialization, and deployment of 
new HPC technologies and infrastructure. The NSCI strives to establish and support a 
collaborative ecosystem in strategic computing that will support scientific discovery and 


economic drivers for the 21st century, and that will not naturally evolve from current commercial 
activity. 


OSTP intends to engage academia, industry, and government in the upcoming months to discuss 
activity in both fields, exchange views on key needs and opportunities, and consider how to 
maintain vibrant and robust national ecosystems for QIS research and development and for high- 
performance computing. These conversations will offer an opportunity to discuss mechanisms 
for addressing challenges in these rapidly-developing fields, including disciplinary and 
institutional boundaries, education and workforce training, and technology and knowledge 
transfer. 


Altaf H. (Tof) Carim is Assistant Director for Research Infrastructure at the White House Office 
of Science and Technology Policy. 


William T. (Tim) Polk is Assistant Director for Cybersecurity at the White House Office of 
Science and Technology Policy. 


Erin Szulman is Policy Advisor to the Chief of Staff at the White House Office of Science and 
Technology Policy. 


Source: https://obamawhitehouse.archives.gov/blog/2016/07/26/realizing-potential-quantum-information-science- 
and-advancing-high-performance 


Quantum Communications 


Quantum information science combines two of the great scientific and technological revolutions 
of the 20th century: quantum mechanics on the one hand, and computer-based information 
science on the other. One of the fundamentally important research areas involved in quantum 
information science is quantum communications, which deals with the exchange of information 
encoded in quantum states of matter or quantum bits (known as qubits) between both nearby and 
distant quantum systems. 


In July 2016, the National Science and Technology Council of the Executive Office of the 
President, in a report titled "Advancing Quantum Information Science: National Challenges and 
Opportunities", described Quantum Information Science (QIS) is “‘a foundational science,” with 
“currently envisioned applications (that) include sensing and metrology, communications, 
simulation, and high-performance computing”. The report also pointed out specifically that 
“Quantum communication, the ability to transmit information encoded in quantum states of light 
or matter, ... is currently an active area of development”. The report also states that “In the 
longer term, quantum networks will connect distributed quantum sensors... to allow long- 
distance transmission of quantum information”. It further stated that solutions “could, with 
consistent attention and support, appear within 5 to 10 years.” 


In support of this initiative, the Quantum Communication Project in ITL performs fundamental 
research on the creation, transmission, interfacing, storage, processing and measurement of 
optical qubits — the quantum states of photons. Particular attention is paid to applying this 
research to future quantum information technologies. 


Our accomplishments include 


e high-speed quantum key distribution (QKD) systems for secure communications; 

e narrow linewidth single photon sources for atomic interfacing; 

e single-photon frequency conversion technologies to interface stationary qubits in the 
visible band with flying qubits in the telecommunication bands; 

e efficient single photon detectors and ultra-high sensitivity spectrometers for the telecom 
wavelengths based on up-conversion technologies. 


Our current research program is focused on the development and implementation of quantum 
repeaters. A quantum repeater enables quantum information exchange between two distant 
quantum systems. Quantum repeaters can be used to extend the operating distance for secure 
communications as well as to form future quantum networks. Our ongoing research aims to 
develop and implement and characterize the essential building blocks for quantum repeaters 
including single photon pair sources, quantum memories and quantum interfaces that can be 
practical and scalable when integrated into a quantum communication system. The figure shows 
our project roadmap. 
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The figure shows our project roadmap. 


In summary, we perform research and development (R&D) on quantum repeaters and supporting 
measurement technologies. Our mission is to bridge the gap between fundamental quantum 
research and practical applications in industries and commercialization. Our R&D is aimed to 
promote US innovation, industrial competitiveness and enhance the nation's security. For more 
information, contact project leader Dr. Xiao Tang. For more information concerning the ITL 
Quantum Information program, please select link 'ITL Quantum Information Program’. 
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Quantum Computing at NASA 


NASA’s QuAIL team aims to demonstrate that quantum computing and quantum algorithms 
may someday dramatically improve the agency’s ability to solve difficult optimization problems 
for missions in aeronautics, Earth and space sciences, and space exploration. 


Support structure for installation of the D-Wave Vesuvius processor, which is cooled to 20 
millikelvin (near absolute zero). 


The hope is that quantum computing will vastly improve a wide range of tasks that can lead to 
new discoveries and technologies, and which may significantly change the way we solve real- 
world problems. 


Beginning with the D-Wave Two™ quantum computer, NASA’s QuéAIL team is evaluating 
various quantum computing approaches to help address NASA challenges. Initial work focuses 
on theoretical and empirical analysis of quantum annealing approaches to difficult optimization 
problems. 


The research team is also studying how the effects of noise, imprecision in the quantum 
annealing parameters, and thermal processes affect the efficacy and robustness of quantum 
annealing approaches to these problems. Over the next five years, the team will also develop 
quantum AI algorithms, problem decomposition and hardware embedding techniques, and 
quantum-classical hybrid algorithms. 


NASA welcomes researchers at other institutions who are interested in collaborating with the 
QuAIL team in these areas to contact the QuAIL team. 


Support structure for installation of the D-Wave Vesuvius processor, 
which is cooled to 20 millikelvin (near absolute zero). 


In support of NASA's Quantum Artificial Intelligence Laboratory (QUAIL), the NAS facility 
hosts a 1,097-qubit D-Wave 2X™ quantum computer. The QuAIL project is a collaborative 
effort among NASA, Google, and Universities Space Research Association (USRA) to explore 
the potential for quantum computers to tackle optimization problems that are difficult or 
impossible for traditional supercomputers to handle. 


Source: https://ti.arc.nasa.gov/tech/dash/groups/physics/quail/ 
https://www.nas.nasa.gov/projects/quantum.html 


Quantum Programs at IARPA 


As part of its mission to address some of the most difficult challenges in the Intelligence 
Community by investing in high-risk, high-payoff research, [ARPA sponsors several applied 
research programs that explore the potential and possibilities in quantum computing. Current and 
previous quantum computing programs include: 


Coherent Superconducting Qubits (CSQ), which is designed to demonstrate a reproducible, 
ten-fold increase in coherence times in superconducting qubits; 


Logical Qubits (LogiQ), which aims to build the first logical qubit; 


Multi-Qubit Coherent Operations (MQCO), which is working to develop the foundation of 
an error-free quantum computer; 


Quantum Computer Science (QCS), which developed the world’s first high-level quantum 
programming language and compilers; and 


Quantum Enhanced Optimization (QEO), which seeks to harness quantum effects required 
to enhance quantum annealing solutions to hard combinatorial optimization problems. 


Quantum Computer Science (QCS) 


Quantum computing holds great promise for solving important classically intractable 
computational problems. Ongoing work in theoretical and experimental physics continues to 
make advances in a number of technologies that might one day underlay a quantum information 
processor. Relatively little investment has been made in exploring the computer science side of 
quantum information science (QIS) even though the challenges that quantum computing poses to 
the world of computer science are on a par with the challenges posed to the world of physics. 


The Intelligence Advanced Research Projects Activity IARPA) Quantum Computer Science 
(QCS) Program explores questions relating to the computational resources required to run 
quantum algorithms on realistic quantum computers. 


Any implementation of a quantum algorithm requires not only programming the algorithm at a 
logical level but also the incorporation of error correction and control schemes at the physical 
level, and resource estimation must account for all of these factors. The QCS program is 
developing a tool chain to study these issues throughout the computing process. 


The tools will include an integrated development environment for the quantum programming 
languages already developed by the program, compilers to generate logical circuits, and tools for 
analyzing quantum error correction and control protocols. Through its research QCS will build a 
foundation for measuring and reducing the resources required to program and implement 
complex quantum algorithms of realistic size. 


Source: https://www.iarpa.gov/index.php/research-programs/qcs 


Quantum computers are in theory capable of simulating the interactions of molecules at a level 
of detail far beyond the capabilities of even the largest supercomputers today. Such simulations 
could revolutionize chemistry, biology and materials science, but the development of quantum 
computers has been limited by the ability to increase the number of quantum bits, or qubits, that 
encode, store and access large amounts of data. 


In a paper published in the Journal of Applied Physics, a team of researchers at the Georgia Tech 
Research Institute (GTRI) and Honeywell International have demonstrated a new device that 
allows more electrodes to be placed on a chip — an important step that could help increase qubit 
densities and bring us one step closer to a quantum computer that can simulate molecules or 
perform other algorithms of interest. This work was funded by the Intelligence Advanced 
Research Projects Activity (IARPA). 


Source: https://www.iarpa.gov/index.php/newsroom/iarpa-in-the-news/20 15/509-new-chip-architecture-may- 


provide-foundation-for-quantum- 
computer?highlight=W yJxdWFudHVtliwiY 29tcH VOZXIiLCJjb21wdXRlcidzliwicX VhbnR1bSBjb2 1wdXRIciJd 


Coherent Superconducting Qubits (CSQ) 


The goal of the CSQ program is to demonstrate a reproducible, ten-fold increase in coherence 
times in superconducting qubits. To achieve this goal, researchers are focused on developing 1) 


fundamental understanding of defects that currently limit coherence times (T1 and T2) and 
readout fidelity; 2) means to characterize, measure and definitively discriminate between 
separate defect mechanisms contributing to loss and dephasing; and 3) novel designs, materials 
and fabrication methods to eliminate these defects. 


Logical Qubits (LogiQ) 


The LogiQ Program seeks to overcome the limitations of current multi-qubit systems by building 
a logical qubit from a number of imperfect physical qubits. LogiQ envisions that program 
success will require a multi-disciplinary approach that increases the fidelity of quantum gates, 
state preparation, and qubit readout; improves classical control; implements active quantum 
feedback; has the ability to reset and reuse qubits; and performs further system improvements. 


Additionally, LogiQ seeks a modular architecture design of two coupled logical qubits that 
creates a flexible and feasible path to larger systems. Modular designs facilitate the incorporation 
of next-generation advances with minimal constraints, while maintaining or improving 
performance. 


Multi-Qubit Coherent Operations (MQCO) 


The Multi-Qubit Coherent Operations Program aims to resolve the technical challenges involved 
in fabricating and operating multiple qubits in close proximity. The main themes of the program 
include qubit fabrication and yield; cross talk within the multi-qubit system; incorporation of the 
controls necessary to operate multiple qubits; coupling qubits to generate a universal gate set for 
quantum operations; and minimizing the overall system footprint. The program is comprised of 
different technologies including atomic and solid state based qubits. The end goal of the program 
is to execute quantum algorithms using multiple qubits and to evaluate the performance using a 
metric that can scale to higher qubit numbers. 


Quantum Enhanced Optimization (QEO) 


QEO seeks to harness quantum effects required to enhance quantum annealing solutions to hard 
combinatorial optimization problems. The physics underlying quantum enhancement will be 
corroborated by design and demonstration of research-scale annealing test beds comprised of 
novel superconducting qubits, architectures, and operating procedures. All work will serve to 
demonstrate a plausible path to enhancement and a basis for design of application-scale quantum 
annealers. 


State preservation by repetitive error detection in a superconducting quantum circuit 


In 2015 IRAPA stated: Quantum computing becomes viable when a quantum state can be 
protected from environment-induced error. If quantum bits (qubits) are sufficiently reliable, 
errors are sparse and quantum error correction (QEC) is capable of identifying and correcting 
them. Adding more qubits improves the preservation of states by guaranteeing that increasingly 
larger clusters of errors will not cause logical failure—a key requirement for large-scale systems. 
Using QEC to extend the qubit lifetime remains one of the outstanding experimental challenges 
in quantum computing. Here we report the protection of classical states from environmental bit- 
flip errors and demonstrate the suppression of these errors with increasing system size. We use a 
linear array of nine qubits, which is a natural step towards the two-dimensional surface code 
QEC scheme7, and track errors as they occur by repeatedly performing projective quantum non- 
demolition parity measurements. Relative to a single physical qubit, we reduce the failure rate in 
retrieving an input state by a factor of 2.7 when using five of our nine qubits and by a factor of 
8.5 when using all nine qubits after eight cycles. Additionally, we tomographically verify 
preservation of the non-classical Greenberger-Horne—Zeilinger state. The successful suppression 
of environment-induced errors will motivate further research into the many challenges associated 
with building a large-scale superconducting quantum computer. 


Source: https://www.iarpa.gov/index.php/newsroom/iarpa-in-the-news/2015/457-state-preservation-by-repetitive- 
error-detection-in-a-superconducting-quantum- 
circuit ?highlight=W yJxdWFudHVtliwiY 29tcH VOZXTiLCJjb2 1 wdXRlcidzliwicX VhbnR1bSBjb21wdXRIciJd 


NIST is a leader in Research in Quantum Science 


Quantum physics drives much of the research at the National Institute of Standards and 
Technology (NIST). Explaining this research is a challenge, because quantum physics—nature's 
rules for the smallest particles of matter and light—inspires words like weird, curious, and 
counter-intuitive. The quantum world is strange and invisible in the context of everyday life. And 
yet, quantum physics can be explained and at least partially demonstrated visually. 


By its very nature, quantum science sets fundamental limits on precision measurements, so by 
necessity NIST is a leader in basic and applied research in quantum science. Some of the most 
fundamental quantum research in the world is carried out in partnerships between NIST and top 
universities, such as JILA (link is external), the Joint Quantum Institute (JQD) (link is external) 
and the Joint Center for Quantum Information and Computer Science (QuICS) (link is external). 
Scientists in these institutes leverage the combined resources of the partners to advance research 
in the control of atoms and molecules and development of ultra-fast lasers capable of 
manipulating states of matter. The discoveries that have been made in these institutes continue to 
be applied at NIST to meeting new measurement challenges, such as the development of the 
world’s best atomic clocks and lasers. 


An emerging research focus at NIST is understanding the potential for quantum-based 
technology to transform security, computing and communications, and to develop the 
measurement and standards infrastructure necessary to exploit this potential. Breakthroughs at 
NIST enabled the first forays into real-world quantum computing and tested the limits of 
quantum information and security. NIST is also developing the technology to harness the power 
of quantum computing in the everyday world through nanotechnology. 


Source: https://www.nist.gov/topics/quantum-information-science 


NIST physicist Ray Simmonds recently collaborated with MFA graduate candidate Sam Mitchell 
of the University of California, San Diego (UCSD), to create a dance piece based on the laws of 
quantum physics. The piece, Dunamis Novem (link is external) (Latin for "the chance happening 
of nine things"),* premiered at The La Jolla Playhouse Forum Theatre in January, as a part of 
Mitchell's thesis work. 


The project has practical benefits such as education, Simmonds says. "While quantum mechanics 
is a well-established theory, proven true overwhelmingly by experiments, it is still confounding 
to most people, even those in science," Simmonds and Mitchell noted in describing their work. 


"At its heart, it describes nature in terms of possible realities with probable outcomes, with 
almost no predictable certainty. We have taken some of the probabilistic rules that govern 
quantum systems and integrated them into a creative process. The results are then born from an 
artistic aesthetic and an algorithmic code that produces dynamics that embody in some way 
randomness, concepts of quantum entanglement, and the effects of observation or measurement." 


The dances are based on nine quantized energy levels of a harmonic oscillator—like the 
mechanical micro-drum built in Simmonds' NIST lab (see animation)—with each successive 
level exactly one ‘quantum’ or unit of energy higher than the level just below. For each level, 
Mitchell created corresponding dance actions or phrases with increasing intensities of movement, 
with names like "crumble" and "hug the world". Dancers are much more likely to remember 
choreography through a visual description than a number. 


Simmonds arranged for a random number generator to produce sequences of the numbers from 
0-8, representing either smooth oscillating or noisy, "hot" motion. Four sequences of both types 
of motion were generated, one for each of the four dancers. How the dancers negotiated the 
space together, the lighting, and the music were all chosen to help emulate the ambiance of these 
orderly or noisy types of quantum motion. 


Overall, the dances demonstrate several features of the quantum world, with the dancers 
representing both the individual and collective behavior of an oscillator, with particles or quanta 
of energy randomly appearing and disappearing. This unpredictable behavior is characteristic of 
the quantum world. Each dancer forms a piece of a quantum "superposition"— multiple 
coexisting energy states—which can characterize the movements of an oscillator. 


To demonstrate quantum entanglement, the four dancers touch each other and their sequences 
then become synchronized, evoking a linkage or correlation among their individual behaviors. 
Entanglement is essential for technologies such as quantum computers, which, if they can be 
built, could solve problems considered intractable today. Simmonds' research group relies on 
quantum properties like this; they have entangled the motion of the micro-drum with microwave 


light particles. The dance also demonstrates that a measurement, symbolized by a beam of light, 
can cause a quantum state or entanglement to collapse, as shown by one dancer falling out of 
synch with the others. 


*Simmonds explains: "Dunamis is Aristotle's Latin term meaning that something 'might chance 
to happen or not to happen.’ Novem is Latin for the number nine. We stuck it together to mean 
the chance happening of nine things." 


Q & A with Physicist Ray Simmonds and Choreographer Sam Mitchell 
1. What got you interested in dancing and dance choreography? 


Mitchell: It was such a perfect combination of everything I loved about sports, art and music. 
Dance and choreography are really challenging fields for people with limitless imaginations. 


Simmonds: I always liked the freedom I felt when dancing. I could be creative and just let go of 
my analytic mind. This is true during choreography too. Analysis can then happen later. 


2. What inspired you to combine dance with quantum physics? 
Mitchell: It was a book that I read in 1995 called "The Tao of Physics". 


Simmonds: I always found it surprising how simple rules can lead to complex behavior. Brian 
Eno explored this when generating ambient music. It seemed that the natural laws of quantum 
physics could also play out in a human dance. And, a performance like this could help educate 
through a physical experience. 


3. What was the most challenging part of this project? 


Mitchell: Trying to get the dancers to understand our process and have them be okay with not 
being entirely in the spotlight. We created this work from a holistic approach vs. from the 
individual's point of view. That can be hard for performers. As you can see, they met the 
challenge! 


Simmonds: Working close to my computer and far away from Sam and the dancers! 


Sam Mitchell is a director/choreographer. He is originally from Imperial Valley, California, and 
is of Native American descent, from the Yaqui tribe. Sam earned a BFA in dance from 
University of California (UC) Santa Barbara and an MFA in choreography from UC San Diego 
and will soon begin a PhD program in drama and theatre at UC San Diego/UC Irvine. Sam 
teaches dance and movement workshops throughout the United States and abroad. He enjoys 
surfing, playing guitar and relaxing at home with his wife and son. 


Ray Simmonds is a physicist. He grew up in the San Francisco Bay Area. He attended Santa 
Barbara City College, where he studied mechanical engineering and dramatic arts, before 
transferring to the University of California, Berkeley, where he received MS and PhD degrees in 
physics. As an undergraduate he participated in modern dance and theater performances and took 
classes in modern dance. In 2002 Ray joined the National Institute of Standards & Technology 
(NIST) in Boulder, Colorado, where he conducts quantum physics research. Ray enjoys spending 
time with his wife and two children and gets outdoors as much as possible. 


Source: https://www.nist.gov/news-events/news/20 15/05/what-quantum-physics-dancers-explain 


NIST Kicks Off Effort to Defend Encrypted Data from Quantum Computer Threat 


If an exotic quantum computer is invented that could break the codes we depend on to protect 
confidential electronic information, what will we do to maintain our security and privacy? That's 
the overarching question posed by a new report from the National Institute of Standards and 
Technology (NIST), whose cryptography specialists are beginning the long journey toward 
effective answers. 


NIST Internal Report (NISTIR) 8105: Report on Post-Quantum Cryptography details the status 
of research into quantum computers, which would exploit the often counterintuitive world of 
quantum physics to solve problems that are intractable for conventional computers. If such 
devices are ever built, they will be able to defeat many of our modern cryptographic systems, 
such as the computer algorithms used to protect online bank transactions. NISTIR 8105 outlines 
a long-term approach for avoiding this vulnerability before it arises. 


"There has been a lot of research into quantum computers in recent years, and everyone from 
major computer companies to the government want their cryptographic algorithms to be what we 


me 


call quantum resistant,'" said NIST mathematician Dustin Moody. "So if and when someone 


does build a large-scale quantum computer, we want to have algorithms in place that it can't 
crack." 


The report shares NIST's current understanding of the status of quantum-resistant cryptography, 
and details what the agency is doing to mitigate risk in the future. One overall recommendation 
for the near term is that organizations focus on "crypto agility," or the rapid ability to switch out 
whatever algorithms they are using for new ones that are safer. 


Creating those newer, safer algorithms is the longer-term goal, Moody says. A key part of this 
effort will be an open collaboration with the public, which will be invited to devise and vet 
cryptographic methods that—to the best of experts' knowledge—will be resistant to quantum 
attack. NIST plans to launch this collaboration formally sometime in the next few months, but in 
general, Moody says it will resemble past competitions (link is external) such as the one for 
developing the SHA-3 hash algorithm, used in part for authenticating digital messages. 


"It will be a long process involving public vetting of quantum-resistant algorithms," Moody said. 
"And we're not expecting to have just one winner. There are several systems in use that could be 
broken by a quantum computer—public-key encryption and digital signatures, to take two 
examples—and we will need different solutions for each of those systems." 


Many current algorithms rely on the difficulty that conventional computers have with factoring 
very large numbers, a difficulty that a quantum computer can overcome. Defenses that rely on 
different mathematical approaches might stymie a quantum computer, and there is worldwide 
research interest in developing them. 


While no one has yet come close to building a quantum computer that could threaten the systems 
we currently use, Moody says it is important to think about the future before it arrives, as it will 
take years to vet the candidates. 


"Historically, it has taken a long time from deciding a cryptographic system is good until we 
actually get it out there as a disseminated standard in products on the market. It can take 10 to 20 
years," he said. "Companies have to respond to all the changes. So we feel it's important to start 
moving on this now.” 


NIST Adds to Quantum Computing Toolkit with Mixed-Atom Logic Operations 
December 16, 2015 


BOULDER, Colo.—Physicists at the National Institute of Standards and Technology (NIST) have 
added to their collection of ingredients for future quantum computers by performing logic 
operations—basic computing steps—with two atoms of different elements. This hybrid design 
could be an advantage in large computers and networks based on quantum physics. 


The NIST experiment, described in the Dec. 17, 2015, issue of Nature (link is external), 
manipulated one magnesium and one beryllium ion (charged atom) confined in a custom trap 
(see photo). The scientists used two sets of laser beams to entangle the two ions—establishing a 
special quantum link between their properties—and to perform two types of logic operations, a 
controlled NOT (CNOT) gate and a SWAP gate. The same issue of Nature describes similar 
work with two forms of calcium ions performed at the University of Oxford. 


"Hybrid quantum computers allow the unique advantages of different types of quantum systems 
to be exploited together in a single platform," said lead author Ting Rei Tan. "Many research 
groups are pursuing this general approach. Each ion species is unique, and certain ones are better 
suited for certain tasks such as memory storage, while others are more suited to provide 
interconnects for data transfer between remote systems." 


Gates are used to build circuits or programs. As in classical computing, a quantum bit (qubit) can 
have a value of 0 or 1. But unlike classical bits, a qubit can also be in a "superposition" of both 0 
and | values at the same time. In the NIST experiment, the qubits are based on the ions' spin 
directions (spin up is | and spin down is 0). A CNOT gate flips the second (target) qubit if the 
first (control) qubit is a 1; if it is a O, the target bit is unchanged. If the control qubit is in a 
superposition, the ions become entangled. A SWAP gate interchanges the qubit states, including 
superpositions. 


The two types of ions vary in their response to light, so lasers can be tuned to manipulate one 
without disturbing the other. This minimizes interference. But getting the whole setup to operate 
coherently was a challenge. The researchers developed a technique to track and stabilize the laser 
beam phases, that is, the exact positions of the undulating light waves. 


"For the logic gate to work, the phase has to be at the correct values. Also, these phases have to 
be stable, so we can apply the same condition over many repetitions," Tan said. 


If they can be built, quantum computers could solve problems now considered intractable, such 
as breaking today's best data encryption codes. The same NIST group has demonstrated many 
other building blocks for quantum computers based on trapped ions. For example, the group 
demonstrated the first quantum logic gate (a CNOT gate) on individual qubits in 1995 using a 
single beryllium ion. 


NIST's latest techniques provide a complete or "universal" set of quantum gates—meaning they 
could perform any possible computation—using ions of multiple elements. A universal set of 
quantum gates is one of the so-called DiVincenzo criteria (link is external), which describe the 
elements needed to build a practical quantum computer. 


NIST's new mixed-atom gates could also help make better simulators to model quantum systems 
and could enable faster and simpler measurements in applications such as NIST's experimental 
quantum logic clock. 


The mixed-atom gates rely on NIST's technique for entangling ions demonstrated more than a 
decade ago. Multiple carefully tuned laser beams apply an oscillating force to a pair of ions. If 
the ions are in different internal states, they feel different laser forces that alter the ions' external 
motions. This coupling of internal states with external motions has the effect of entangling the 
ions. 


The research was supported by the Office of the Director of National Intelligence, Intelligence 
Advanced Research Projects Activity, and the Office of Naval Research. 


Source: T.R. Tan, J.P. Gaebler, Y. Lin, Y. Wan, R. Bowler, D. Leibfried and D.J. Wineland. 2015. Multi-element 
logic gates for trapped ion qubits. Nature. Dec. 17. DOI: 10.1038/nature16186 https://www.nist.gov/news- 
events/news/2015/12/nist-adds-quantum-computing-toolkit-mixed-atom-logic-operations 


NSF invests $30 million to pursue transformative advances at frontiers of computing and 
information science 


New Expeditions in Computing awards represent NSF’s single largest investments in the field 


February 27, 2018 


The National Science Foundation (NSF) announces three new Expeditions in Computing awards, 
each providing $10 million in funding over five years to multi-investigator research teams 
pursuing large-scale, far-reaching and potentially transformative research in computer and 
information science and engineering. This year's awards aim to enable game-changing advances 
in real-time decision making, quantum computing and non-invasive biomedical imaging. 


"The Expeditions projects being awarded today are not only taking on challenging research 
problems in computer and information science and engineering, but they are also offering the 
potential to yield tremendous benefits to multiple sectors of our society," said Jim Kurose, NSF 
assistant director for Computer and Information Science and Engineering. "We are delighted to 
be able to fund these projects, which represent the largest single investments in our portfolio." 


Since the inception of the program a decade ago, NSF has funded 22 Expeditions in Computing 
awards, including these three. Over the years, NSF-funded Expeditions awards have pursued 
foundational research in a range of areas spanning computing hardware and software, wireless 
networks, robotics, Big Data, artificial intelligence (AJ), and synthetic biology and molecular 
programming, to name a few. 


This year's projects aim to revolutionize the design and development of secure, autonomous 
systems. They also aim to more rapidly bring to market practical applications of quantum 
computing and enable non-invasive and easy-to-use diagnostic imaging of the human body that 
could increase the quality of healthcare in remote areas. Below are descriptions of the three 
projects funded this year, along with their principal investigators and associated institutions. 


Secure, Real-Time Decisions on Live Data, Ion Stoica, University of California, Berkeley. 


A new era is rising in which AI systems will play an increasingly central role in people’s lives 
by revolutionizing healthcare, transportation and the way business is conducted. This 
Expeditions project seeks to build AI decision systems to address these challenges by developing 
open source platforms, tools and algorithms for Real-time, Intelligent, Secure and Explainable 
(RISE) decisions. The project will also empower a large community of pioneers to build 
innovative applications and solutions, as well as broaden participation in research activities by 
allowing students and researchers across many disciplines to contribute. 


Enabling Practical-scale Quantum Computing, Frederic Chong, The University of Chicago. 


Quantum computing sits at the precipice of a potentially game-changing revolution in the field 
of computer and information science. Quantum machines may soon be capable of performing 
computations that advance AI, computer security, chemistry and other fields in ways that are 
extremely difficult or even impossible for today's computers. The multi-institutional Enabling 
Practical-scale Quantum Computing (EPiQC) Expeditions project will help accelerate the 
potential of this new paradigm by reducing the gap that exists today between theoretical 
algorithms and practical quantum computing architectures. By developing new algorithms, 
software and hardware designs tailored to key properties of quantum technologies capable of 100 
to 1,000 quantum bits -- where a quantum bit is the single unit of quantum information -- this 
project will increase the efficiency of practical quantum computation and aid in transitioning 
quantum computing out of the laboratory and into practical use. Partnering institutions include 
the Georgia Institute of Technology, Massachusetts Institute of Technology, Princeton 
University and University of California, Santa Barbara. 


Computational Photo-Scatterography: Unraveling Scattered Photons for Bio-imaging, 
Ashutosh Sabharwal, Rice University. 


Light scatters as it travels through the human body. As this happens, the spatial information 
from different points within the body becomes entangled. The principal goal of this Expeditions 
project is to develop a computational imaging system, called Computational Photo- 
Scatterography (CPS), that effectively unravels scattered light and facilitates non-invasive bio- 
imaging deep beneath the skin at cellular-level resolutions. The project has the potential to 
fundamentally transform medicine and healthcare delivery by enabling live views of cross 
sections of human anatomy simply by pointing a camera at any part of the body. Such an 
advancement would put individual users at the center of their healthcare experience and make 


them true partners in diagnosis, treatment and wellness. Beyond healthcare, the project could 
lead to cross-cutting applications in consumer imaging, automotive navigation, robotics, 
surveillance, atmospheric science, materials science and more. Partnering institutions include 
Carnegie Mellon University, Cornell University, Harvard University and the Massachusetts 
Institute of Technology. 


The National Science Foundation (NSF) is an independent federal agency that supports 
fundamental research and education across all fields of science and engineering. In fiscal year 
(FY) 2017, its budget is $7.5 billion. NSF funds reach all 50 states through grants to nearly 2,000 
colleges, universities and other institutions. Each year, NSF receives more than 48,000 
competitive proposals for funding and makes about 12,000 new funding awards. 


Source: https://nsf.gov/news/news_summ.jsp?cntn_id=244648&org=NSF 
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Introduction 


Chairwoman Comstock, Ranking Member Lipinski, Chairman Weber, Raking Member Veasey, 
and members of the Subcommittees, [am Dr. Carl Williams, the Acting Director of the Physical 
Measurement Laboratory (PML) at the Department of Commerce’s National Institute of 
Standards and Technology (NIST). Thank you for the opportunity to appear before you today to 
discuss NIST’s roles in quantum science and quantum computing. 


As this nation’s national metrology institute, NIST’s overall mission is to promote U.S. 
innovation and industrial competitiveness by advancing measurement science, standards, and 
technology in ways that enhance economic security and improve our quality of life. NIST does 
this through programs focused on national priorities from cybersecurity, advanced manufacturing 
and the digital economy to precision metrology, biosciences, and more. 


NIST conducts basic and applied research in quantum science to advance the field of 
fundamental metrology as part of its core mission, by developing more precise measurement 
tools and technologies to address industry’s increasingly challenging requirements. This work 
has positioned NIST both as a global leader among national metrology institutes, and as one of 
the world’s leading centers of quantum research and engineering. While NIST’s work in 
quantum science is revolutionizing the world of metrology, it also has direct application to 
quantum communications and quantum computation. Today, Ill describe in more detail some of 
NIST’s quantum research efforts and how they are being leveraged to positively advance the 
field. 


Quantum Computing and Quantum Information Science 


Quantum mechanics revolutionized science in the 20th century, leading to technological 
breakthroughs including the invention of the laser and the transistor. Today’s most advanced 
communication and computation technologies are based on those mid-20th century inventions. 


Science and society is poised for a second quantum revolution in the 21st century, one in which 
we will employ our new-found ability to exploit quantum mechanical phenomena to push 
beyond the limits of classical computing and communications. Phenomena such as superposition 
(the ability of a particle to be in several different states at the same time) and entanglement (the 
ability of two particles to share information even at a distance) lie at the heart of what makes a 
quantum computer so much more powerful than even today’s most advanced classical 
supercomputers. 


So, what are quantum computing and quantum information? Unlike classical computers, which 
process high and low voltages as 1’s and 0’s to form bits of information that get shuttled around, 
quantum computers manipulate quantum bits of information, or qubits. A qubit’s information is 
in the form of a discrete state, such as the magnetic spin of an electron. Due to quantum 
mechanical phenomena such as superposition, these qubits can be both a | and a 0 at the same 
time. 


To understand this, we can imagine a normal classical bit as able to represent only two points on 
the surface of a sphere—such as the north and south poles of the earth. In contrast, a qubit could 
represent any point on the surface of that sphere. This superposition, together with the shared 
fate resulting from entanglement between multiple qubits together, is what gives a quantum 
computer the superior computational power that will make it uniquely capable of solving 
complex problems, including perhaps most notably the breaking of current encryption schemes. 


NIST’s expertise in quantum science is mainly focused on the use of quantized states of light and 
matter and their manipulation and interaction as quantum bits of information to make ultra- 
precise sensors and measurement tools. This application falls under a broader field of study that 
we refer to as “quantum information science,” which lies at the intersection of computer science, 
mathematics, and quantum science. The breakthroughs that NIST is making in this field will 
have direct relevance and application to quantum computing. 


Recent Investments and Advancements Abroad 


Many nations view leadership in quantum computing as critical to making significant 
breakthroughs in medicine, manufacturing, artificial intelligence, and defense, and to reaping the 
rewards from those investments and breakthroughs. The U.S. has long been viewed as a leader in 
quantum science, information, and computing. Significant historic investment by the U.S. 
government has supported a robust base of fundamental research, and this has led to several 
transformational breakthroughs in the field. 


Today, U.S. leadership in quantum science and technology is increasingly dependent on 
significant investments from U.S. technology giants and major defense companies with a natural 
interest in the many commercial applications of quantum technology beyond computing. These 
applications include quantum communications, quantum algorithms and software, data security, 
imaging, and quantum sensors, and could be applied to anything from national security to the 
Internet of Things, to advanced sensors for gas and oil exploration. Applications for quantum 
sensors include novel approaches to precision navigation and timing, as well as technologies that 
could provide a backup or holdover function for global positioning systems or GPS. 


While the U.S. has made significant breakthroughs, the rest of the world has not been standing 
still—and U.S. companies are taking notice. Worldwide interest and investment in quantum 
computing and related technologies has spiked in recent years, following important and 
increasingly complex technological demonstrations by overseas research efforts. 


The European Union has launched an effort to invest 2 billion euros over the next 10 years ina 
recently launched EU Flagship Quantum Program. The United Kingdom has created a set of 
quantum hubs aimed at exploiting the various application spaces within quantum information 
science. 


Perhaps even more noteworthy is China’s rapid investment in quantum technology and the 
dramatic advances by China in the area of quantum communication. Earlier this year, China sent 
entangled photons from a satellite to the ground 1200 kilometers away, smashing several 
quantum communication distance records. More recently, China has demonstrated the world’s 
first atomic clock in space using cold atoms, which can far outperform the atomic clocks in U.S. 
GPS, and can further support future advanced quantum networks. 


NIST’s History and Role in Quantum Computing and Information 


At NIST, our researchers study and harness the quantum mechanical properties of light and 
matter in some of the most well-controlled and defined measurement environments to create the 
world’s most sensitive and precise sensors and atomic clocks. NIST has been a leader in the field 
of quantum information from the beginning, and its multiple Nobel Prize-winning contributions 
have helped move quantum computing and quantum information from purely scientific fields of 
study to technological ones. 


NIST scientists began researching quantum information in the early 1990s in their quest to make 
better atomic clocks. Qubits and atomic clocks may seem worlds apart, but experimentally they 
are very much the same thing. By 2000, NIST had established a formal quantum information 
program. 


Atomic Clocks: The Power of One Qubit 


Atomic clocks define the second and tell time with amazing precision. For example, the most 
accurate U.S. atomic clock currently used for defining the second is the NIST-F2. It keeps time 
to an accuracy of less than a millionth of a billionth of a second. Stated in another way, the 
NIST-F2 clock will not lose a second in at least 300 million years. And just this month, NIST 
published a description of a radically new atomic clock design—the three-dimensional (3-D) 
quantum gas atomic clock. With a precision of just 3.5 parts error in 10 quintillion (1 followed 
by 19 zeros) in about 2 hours, it is the first atomic clock to ever reach the 10 quintillion 
threshold, and promises to usher in an era of dramatically improved measurements and 
technologies across many areas based on controlled quantum systems. 


These breakthroughs in precision timekeeping have critical real-world applications to navigation 
and timing. Today, commercial atomic clocks contained in GPS satellites provide the 
timekeeping precision that we take for granted when we use our GPS devices to pinpoint our 
location to within a meter almost anywhere on earth. 


NIST’s most advanced atomic clocks, so precise that they will not lose a second over the life of 
the universe, also are being applied to make the world’s most sensitive measurements of 
quantities other than time. For example, NIST is actively pursuing the use of atomic clocks as 
quantum sensors, another application of quantum information, for a range of entirely new 
technologies. NIST is now able to detect the barely perceptible slowing of time in a large 


gravitational potential. This is the second form of time dilation predicted by Einstein in his 
general theory of relativity and may help scientists detect gravitational waves or prospectors find 
hidden oil reserves and mineral deposits. The technology might even have the potential to allow 
scientists to predict earthquakes days or even weeks before a cataclysmic event. 


Quantum Logic 


NIST’s breakthroughs in the measurement of time also have laid the technological foundations 
for how to manipulate quantum information. NIST’s pioneering work in the cooling and trapping 
of ions and atoms to improve timekeeping provided NIST researchers with the experimental 
platform to demonstrate the first two-qubit quantum logic gate in 1995, by controlling and 
entangling the energy levels of two ions. Logic gates in classical computers are used to process 
information. By analogy, quantum logic gates form the basic building block for quantum 
computing. Scaling up to experiments involving multiple logic gates provides a platform to test 
more complex quantum computing theory. 


Other Quantum Computing Technologies 


Atomic clocks are just one example of NIST’s research focused on measurement science that has 
applications to quantum computing. NIST also is the world’s leader in specially designed 
devices, made from superconductors, known as Josephson Junctions. Josephson Junction 
technology is used by NIST to realize and disseminate NIST’s quantum voltage standard. The 
quantum voltage standard is also integral to the proposed 2019 effort to redefine the international 
system of units (colloquially, the metric system) to be based on fundamental constants of nature, 
as defined through world-leading experiments at NIST such as the “electronic kilogram’. This 
same technology is being explored as a key competitor to trapped ions and atoms as another way 
to manipulate and store quantum information. 


Additionally, Superconductors are used by researchers at NIST to make ultra-sensitive single 
photon detectors used in precision photonic measurements at NIST and by external stakeholders. 
These specially designed sensors have become essential components in experiments at NIST to 
test the foundations of quantum mechanics and realize quantum teleportation. In quantum 
teleportation, quantum information gets transmitted instantaneously from one qubit to another. 
Discrete photons, like ions and atoms, can also be carefully controlled and entangled to form 
qubits. Prior to China’s recent 1200 kilometer demonstration, NIST had held the distance record 
for quantum teleportation, transmitting information between photons separated by 100 


kilometers. Progress in quantum teleportation is expected to be essential for eventual commercial 
quantum computing, and for other forms of quantum information transfer. 


In the end, building a quantum computer will involve many disparate quantum technologies. 
Those technologies will need to be integrated to provide long-term storage and memory, 
transmission or teleportation, transduction, and detection of qubits while not corrupting the 
qubit’s extremely delicate state. 


Quantum Information Theory and Validation and Verification 


In 2002, NIST hired its first quantum information theorist. This began a quantum information 
program which has led to new and improved approaches for quantum error correction, 
techniques for reliably characterizing quantum states produced in the laboratory, and concepts 
for randomized benchmarking of quantum gates. These concepts have provided crucial insights, 
which NIST has used to further improve our experimental efforts and those of other research 
groups. For example, randomized benchmarking has become the standard by which research 
groups around the world characterize and compare the quality of their computational paradigms. 


Quantum Algorithms and Post-Quantum Cryptography 


NIST programs on quantum algorithms and post-quantum cryptography further build on our core 
efforts in quantum information theory with a focus on addressing security challenges anticipated 
when practical quantum computers are realized. NIST, working with industry, has played a 
leading role since the 1970s in developing cryptography standards. Today’s classical computers 
and computer networks employing Public Key Cryptography are using cryptography 
standardized by NIST. Unfortunately, these standards will not be resistant to attack by quantum 
computers. NIST researchers are using their understanding of quantum algorithms to create new 


classical encryption algorithms, commonly referred to as post-quantum cryptography, that will 
be resistant to quantum computing attacks. 


NIST’s Joint Institutes with Universities 


NIST also supports joint centers with the University of Colorado Boulder (CU) and the 
University of Maryland (UMD). JILA at UC was founded in 1962 and has been doing research 
in quantum science and in atomic clocks and is evolving into quantum information science. Two 
joint centers in quantum information science at UMD were established more recently. The Joint 


Quantum Institute (JQI) was established in 2006 through a cooperative effort between NIST, 
UMD, and the Laboratory for Physical Sciences. The Joint Center for Quantum Information and 
Computer Science (QuICS) was established in 2014 to complement JQI’s experimental and 
theoretical work by focusing the use of quantum systems to process, transmit and store quantum 
information. Taken together, NIST’s joint institutes interact strongly to push the frontiers of 
quantum science, information, and computing and provide a training ground for industry’s future 
quantum workforce. 


Conclusion 


NIST recognizes that it has an essential role to play in U.S. leadership in quantum computing and 
information. However, that role is not to build a quantum computer. NIST’s role, consistent with 
its mission, is to develop the foundational knowledge and measurement science support for U.S. 
leadership in quantum computing, to create the basis for characterizing quantum logic gates, to 
explore approaches to quantum control and error correction, to develop rudimentary quantum 
processors that are capable of creating the exotic quantum states that will allow improvement of 
our measurements beyond the standard quantum limit, and to ensure that our cybersecurity 
infrastructure remains resilient in the quantum era. Part of this foundational knowledge will 
come from using NIST’s measurement platforms to experimentally conduct quantum simulations 
and validate quantum computing theory. NIST also anticipates that the early adoption of the 
quantum technologies that emerge as NIST continues to develop the world’s most precise atomic 
clocks (quantum logic clocks) and quantum based sensors will ultimately provide substantial 
support to the effort to build a quantum computer. 


NIST is extremely proud of its world-class quantum science, quantum information, mathematics, 
and computer science programs, and we appreciate the support of this Committee for NIST’s 
research efforts. Sustained advancements by NIST in these fields continue to underpin success in 
many parts of NIST’s measurement science mission and contribute to U.S. leadership in 
quantum computing. Thank you for the opportunity to testify today. I would be happy to answer 
any questions you may have. 


Source: https://www.nist.gov/speech-testimony/american-leadership-quantum-technology 


Simple is Beautiful in Quantum Computing 


Defect spins in diamond were controlled with a simpler, geometric method, leading to faster 
computing. 


Quantum computers use electron spin orientation at a defect site in diamond to store information. 
The electron spin can be up (+1), down (-1), or anything in between. The spin (left, red arrow) is 
represented as a vector on a sphere. To change the spin from Position | to 2 normally requires 
two separate optical pulses. However, here a particular single pulse has accomplished the same 
electronic transition. This single pulse makes the electron travel on a geometric loop, analogous 
to a Mobius strip (right, a surface with one side and one boundary), such that its position is 
changed in a robust way after completing the loop. 


Quantum computing could solve problems impossible for today’s supercomputers. The challenge 
for this new form of computing is processing the quantum bits (qubits) that represent data. A 
qubit can be made by controlling the orientation of an electron’s spin at a defect site in diamond. 
To solve a problem, a quantum computer uses logic gates to couple multiple qubits and output 
new information. Scientists designed a new protocol that can be used to develop fast, robust 
logic gates for qubits. The simple gates reorient electron spin on defect sites in diamond. This 
new finding would allow faster and more efficient manipulation of the electron spins or qubits. 


Researchers exert a new form of fast geometric control on the electron’s spin orientation. This 
enables faster and fewer gates to achieve the same operation on the qubit as conventional 
techniques, thus facilitating the development of future quantum computers. As an added bonus, 
the new gates are also less sensitive to noise than today’s operations (specifically, sequential, 
multi-pulse operations). Noise can destroy quantum information. Controlling qubits has the 
potential to bring us closer to practical quantum computers. It could advance our ability to 
develop high fidelity quantum logic. 


Classical computers are number crunching machines, performing basic arithmetical operations 
on numbers. In computer language, these numbers are expressed in binary number units of zeros 
and ones, also called bits. Each bit, therefore, stores the smallest piece of information and can 
accept a value of either 1 or 0. Similar to classical computers, quantum computers are designed 
to operate on quantum bits. An extraordinary property of qubits is that they can be of any value 
equal to or between -1 and +1, until we measure them. As in a classical computer, the initial 
states of qubits need to be prepared before quantum data processing or data storage. 


Diamond is a very promising material for quantum information processing. In diamond, a 
nitrogen atom can replace a carbon atom. When the nitrogen is next to a missing carbon atom in 
the crystalline lattice, this is called a nitrogen-vacancy defect. As well as possessing charge, this 
impurity possesses a property known as spin that can be used to store quantum information. Its 
spin can be initialized, manipulated, and “read out” with a laser at room temperature, unlike 
other quantum computing architectures that require low temperatures. This single impurity can 
emit one photon at a time. A photon can carry one qubit of information. Researchers discovered 
a simple method to prepare and manipulate the quantum state of a nitrogen-vacancy center acting 
as a qubit. Gates are used to prepare and manipulate the electronic transitions of qubits. A 
geometric gate relies on the evolution or geometric path of the spin instead of energy differences 
involved in the gates used in traditional computers. This particular geometric gate utilizes a 
single laser pulse to send the electron spin through a high-speed cycle. The geometry of the cycle 
is controlled by the single laser pulse and determines the final gate operations and electronic 
transitions. Further, careful control of the pulse energy significantly improved the fidelity of the 
electronic transition compared to traditional multi-pulse techniques, simplifying the path to 
practical quantum technologies. 


Source: https://science.energy. gov/bes/highlights/2017/bes-2017-11-a/ 


Appendix A: Quantum Algorithm Zoo - math.nist.gov 


Source: https://search.usa.gov/search?affiliate=usagov &page=2&query=quantum+computing 


This is a comprehensive catalog of quantum algorithms. If you notice any errors or omissions, please email me at 


stephen -jordan@nist.gov Your help is appreciated and will be acknowledged. 


Algebraic and Number Theoretic Algorithms 

Algorithm: Factoring 

Speedup: Superpolynomial 

Description: Given an n-bit integer, find the prime factorization. The quantum algorithm of Peter Shor solves this in 
O*(n3) time [82,125]. The fastest known classical algorithm for integer factorization is the general number field 
sieve, which is believed to run in time 20°(n1/3). The best rigorously proven upper bound on the classical 
complexity of factoring is O(2n/4+0(1)) via the Pollard-Strassen algorithm [252, 362]. Shor's factoring algorithm 
breaks RSA public-key encryption and the closely related quantum algorithms for discrete logarithms break the 
DSA and ECDSA digital signature schemes and the Diffie-Hellman key-exchange protocol. A quantum algorithm 
even faster than Shor's for the special case of factoring “semiprimes”, which are widely used in cryptography, is 
given in [271]. If small factors exist, Shor's algorithm can be beaten by a quantum algorithm using Grover search to 
speed up the elliptic curve factorization method [366]. Additional optimized versions of Shor's algorithm are given 
in [384, 386]. There are proposed classical public-key cryptosystems not believed to be broken by quantum 
algorithms, cf: [248]. At the core of Shor's factoring algorithm is order finding, which can be reduced to the Abelian 
hidden subgroup problem, which is solved using the quantum Fourier transform. A number of other problems are 
known to reduce to integer factorization including the membership problem for matrix groups over fields of odd 
order [253], and certain diophantine problems relevant to the synthesis of quantum circuits [254]. 


Algorithm: Discrete-log 

Speedup: Superpolynomial 

Description: We are given three n-bit numbers a, b, and N, with the promise that b=asmodN for some s. The task is 
to find s. As shown by Shor [82], this can be achieved on a quantum computer in poly(n) time. The fastest known 
classical algorithm requires time superpolynomial in n. By similar techniques to those in [82], quantum computers 
can solve the discrete logarithm problem on elliptic curves, thereby breaking elliptic curve cryptography [109, 14]. 
A further optimization to Shor's algorithm is given in [385]. The superpolynomial quantum speedup has also been 
extended to the discrete logarithm problem on semigroups [203, 204]. See also Abelian Hidden Subgroup. 


Algorithm: Pell's Equation 

Speedup: Superpolynomial 

Description: Given a positive nonsquare integer d, Pell's equation is x2—dy2=1. For any such d there are infinitely 
many pairs of integers (x,y) solving this equation. Let (x1,y1) be the pair that minimizes x+tyd——V. If d is an n-bit 
integer (i.e. O<d<2n ), (x1,y1) may in general require exponentially many bits to write down. Thus it is in general 
impossible to find (x1,y1) in polynomial time. Let R=log(xl+yld—v). [R] uniquely identifies (x1,y1). As shown by 
Hallgren [49], given a n-bit number d, a quantum computer can find [R] in poly(7) time. No polynomial time 
classical algorithm for this problem is known. Factoring reduces to this problem. This algorithm breaks the 
Buchman-Williams cryptosystem. See also Abelian hidden subgroup. 


Algorithm: Principal Ideal 

Speedup: Superpolynomial 

Description: We are given an n-bit integer d and an invertible ideal / of the ring Z[d——N]. Lisa principal ideal if 
there exists a€Q(d——V) such that I=aZ[d-—v]. a may be exponentially large in d. Therefore @ cannot in general 


even be written down in polynomial time. However, |loga] uniquely identifies a. The task is to determine whether J 
is principal and if so find [loga]. As shown by Hallgren, this can be done in polynomial time on a quantum 
computer [49]. A modified quantum algorithm for this problem using fewer qubits was given in [131]. A quantum 
algorithm solving the principal ideal problem in number fields of arbitrary degree (i.e. scaling polynomially in the 
degree) was subsequently given in [329]. Factoring reduces to solving Pell's equation, which reduces to the principal 
ideal problem. Thus the principal ideal problem is at least as hard as factoring and therefore is probably not in P. See 
also Abelian hidden subgroup. 


Algorithm: Unit Group 

Speedup: Superpolynomial 

Description: The number field Q(@) is said to be of degree d if the lowest degree polynomial of which @ is a root 
has degree d. The set O of elements of Q(@) which are roots of monic polynomials in Z[x] forms a ring, called the 
ring of integers of Q(@). The set of units (invertible elements) of the ring O form a group denoted O+. As shown by 
Hallgren [50], and independently by Schmidt and Vollmer [116], for any Q(@) of fixed degree, a quantum computer 
can find in polynomial time a set of generators for O« given a description of 6. No polynomial time classical 
algorithm for this problem is known. Hallgren and collaborators subsequently discovered how to achieve polynomial 
scaling in the degree [213]. See also [329]. The algorithms rely on solving Abelian hidden subgroup problems over 
the additive group of real numbers. 


Algorithm: Class Group 

Speedup: Superpolynomial 

Description: The number field Q(@) is said to be of degree d if the lowest degree polynomial of which @ is a root 
has degree d. The set O of elements of Q(@) which are roots of monic polynomials in Z[x] forms a ring, called the 
ring of integers of Q(@). For a ring, the ideals modulo the prime ideals form a group called the class group. As 
shown by Hallgren [50], a quantum computer can find in a set of generators for the class group of the ring of 
integers of any constant degree number field, given a description of 6 in time poly(log(|O])). An improved quantum 
algorithm, whose runtime is also polynomial in d was subsequently given in [329]. No polynomial time classical 
algorithm for these problems are known. See also Abelian hidden subgroup. 


Algorithm: Gauss Sums 

Speedup: Superpolynomial 

Description: Let Fg be a finite field. The elements other than zero of Fg form a group Fxg under multiplication, and 
the elements of Fg form an (Abelian but not necessarily cyclic) group F+q under addition. We can choose some 
character yx of Fxq and some character y+ of F+g. The corresponding Gauss sum is the inner product of these 
characters: )\x#0€Fqy+(x)yx(x) As shown by van Dam and Seroussi [90], Gauss sums can be estimated to 
polynomial precision on a quantum computer in polynomial time. Although a finite ring does not form a group 
under multiplication, its set of units does. Choosing a representation for the additive group of the ring, and choosing 
a representation for the multiplicative group of its units, one can obtain a Gauss sum over the units of a finite ring. 
These can also be estimated to polynomial precision on a quantum computer in polynomial time [90]. No 
polynomial time classical algorithm for estimating Gauss sums is known. Discrete log reduces to Gauss sum 
estimation [90]. Certain partition functions of the Potts model can be computed by a polynomial-time quantum 
algorithm related to Gauss sum estimation [47]. 


Algorithm:Solving Exponential Congruences 

Speedup:Polynomial 

Description: We are given a,b,c,f,g€Fq. We must find integers x,y such that afxt+bgy=c. As shown in [111], 
quantum computers can solve this problem in O°(q3/8) time whereas the best classical algorithm requires O"(q9/8) 
time. The quantum algorithm of [111] is based on the quantum algorithms for discrete logarithms and searching. 


Algorithm: Matrix Elements of Group Representations 

Speedup: Superpolynomial 

Description: All representations of finite groups and compact linear groups can be expressed as unitary matrices 
given an appropriate choice of basis. Conjugating the regular representation of a group by the quantum Fourier 
transform circuit over that group yields a direct sum of the group's irreducible representations. Thus, the efficient 
quantum Fourier transform over the symmetric group [196], together with the Hadamard test, yields a fast quantum 
algorithm for additively approximating individual matrix elements of the arbitrary irreducible representations of Sn. 
Similarly, using the quantum Schur transform [197], one can efficiently approximate matrix elements of the 
irreducible representations of SU(n) that have polynomial weight. Direct implementations of individual irreducible 
representations for the groups U(n), SU(n), SO(n), and An by efficient quantum circuits are given in [106]. Instances 
that appear to be exponentially hard for known classical algorithms are also identified in [106]. 


Algorithm: Verifying Matrix Products 

Speedup: Polynomial 

Description: Given three nxn matrices, A,B, and C, the matrix product verification problem is to decide whether 
AB=C. Classically, the best known algorithm achieves this in time O(n2), whereas the best known classical 
algorithm for matrix multiplication runs in time O(n2.373). Ambainis et al. discovered a quantum algorithm for this 
problem with runtime O(n7/4) [6]. Subsequently, Buhrman and Spalek improved upon this, obtaining a quantum 
algorithm for this problem with runtime O(75/3) [19]. This latter algorithm is based on results regarding quantum 
walks that were proven in [85]. 


Algorithm: Subset-sum 

Speedup: Polynomial 

Description: Given a list of integers x1,...,xn, and a target integer s, the subset-sum problem is to determine 
whether the sum of any subset of the given integers adds up to s. This problem is NP-complete, and therefore is 
unlikely to be solvable by classical or quantum algorithms with polynomial worst-case complexity. In the hard 
instances the given integers are of order 2n. In [178], a quantum algorithm is given that solves this problem in time 
20.241n, up to polynomial factors. This quantum algorithm works by applying a variant of Ambainis's quantum 
walk algorithm for element-distinctness [7]to speed up a sophisticated classical algorithm for this problem due to 
Howgrave-Graham and Joux. The fastest known classical algorithm for subset-sum runs in time 20.291n, up to 
polynomial factors. 


Algorithm: Decoding 

Speedup: Varies 

Description: Classical error correcting codes allow the detection and correction of bit-flips by storing data 
reduntantly. Maximum-likelihood decoding for arbitrary linear codes is NP-complete in the worst case, but for 
structured codes or bounded error efficient decoding algorithms are known. Quantum algorithms have been 
formulated to speed up the decoding of convolutional codes [238] and simplex codes [239]. 


Algorithm: Constraint Satisfaction 

Speedup: Polynomial 

Description: Constraint satisfaction problems, many of which are NP-hard, are ubiquitous in computer science, a 
canonical example being 3-SAT. If one wishes to satisfy as many constraints as possible rather than all of them, 
these become combinatorial optimization problems. (See also entry on adiabatic algorithms.) The brute force 
solution to constraint satisfaction problems can be quadratically sped up using Grover's algorithm. However, most 
constaint satisfaction problems are solvable by classical algorithms that (although still exponential-time) run more 
than quadratically faster than brute force checking of all possible solutions. Nevertheless, a polynomial quantum 
speedup over the fastest known classical algorithm for 3-SAT is given in [133], and polynomial quantum speedups 
for some other constraint satisfaction problems are given in [134, 298]. A commonly used classical algorithm for 


constraint satisfaction is backtracking, and for some problems this algorithm is the fastest known. A general 
quantum speedup for backtracking algorithms is given in [264]. 


Algorithm: Quantum Cryptanalysis 

Speedup: Various 

Description: It is well-known that Shor's algorithms for factoring and discrete logarithms [82,125] completely break 
the RSA and Diffie-Hellman cryptosystems, as well as their elliptic-curve-based variants [109, 14]. (A number of 
"post-quantum”" public-key cryptosystems have been proposed to replace these primitives, which are not known to 


be broken by quantum attacks.) Beyond Shor's algorithm, there is a growing body of work on quantum algorithms 
specifically designed to attack cryptosystems. These generally fall into three categories. The first is quantum 
algorithms providing polynomial or sub-exponential time attacks on cryptosystems under standard assumptions. In 
particular, the algorithm of Childs, Jao, and Soukharev for finding isogenies of elliptic curves breaks certain elliptic 
curve based cryptosystems in subexponential time that were not already broken by Shor's algorithm [283]. The 
second category is quantum algorithms achieving polynomial improvement over known classical cryptanalytic 
attacks by speeding up parts of these classical algorithms using Grover search, quantum collision finding, etc. Such 
attacks on private-key [284, 285, 288, 315, 316] and public-key [262, 287] primitives, do not preclude the use of the 
associated cryptosystems but may influence choice of key size. The third category is attacks that make use of 
quantum superposition queries to block ciphers. These attacks in many cases completely break the cryptographic 


primitives [286, 289, 290, 291, 292]. However, in most practical situations such superposition queries are unlikely to 
be feasible. 


Oracular Algorithms 

Algorithm: Searching 

Speedup: Polynomial 

Description: We are given an oracle with N allowed inputs. For one input w ("the winner") the corresponding 
output is 1, and for all other inputs the corresponding output is 0. The task is to find w. On a classical computer this 
requires Q(N) queries. The quantum algorithm of Lov Grover achieves this using O(N--V) queries [48], which is 
optimal [216]. This has algorithm has subsequently been generalized to search in the presence of multiple "Winners" 
[15], evaluate the sum of an arbitrary function [15,16,73], find the global minimum of an arbitrary function [35,75, 
255], take advantage of alternative initial states [100] or nonuniform probabilistic priors [123], work with oracles 
whose runtime varies between inputs [138], approximate definite integrals [77], and converge to a fixed-point [208, 
209]. The generalization of Grover's algorithm known as amplitude estimation [17] is now an important primitive in 
quantum algorithms. Amplitude estimation forms the core of most known quantum algorithms related to collision 
finding and graph properties. One of the natural applications for Grover search is speeding up the solution to NP- 
complete problems such as 3-SAT. Doing so is nontrivial, because the best classical algorithm for 3-SAT is not 
quite a brute force search. Nevertheless, amplitude amplification enables a quadratic quantum speedup over the best 
classical 3-SAT algorithm, as shown in [133]. Quadratic speedups for other constraint satisfaction problems are 


obtained in [134]. For further examples of application of Grover search and amplitude amplification see [261, 262]. 
A problem closely related to, but harder than, Grover search, is spatial search, in which database queries are limited 
by some graph structure. On sufficiently well-connected graphs, O(n——\) quantum query complexity is still 
achievable [274,275,303, 304, 305, 306, 330]. 


Algorithm: Abelian Hidden Subgroup 

Speedup: Superpolynomial 

Description: Let G be a finitely generated Abelian group, and let H be some subgroup of G such that G/H is finite. 
Let f be a function on G such that for any g1,g2€G, f(g1)=f(g2) if and only if g1 and g2 are in the same coset of H. 
The task is to find H (i.e. find a set of generators for H) by making queries to f: This is solvable on a quantum 


computer using O(log|G]) queries, whereas classically Q(|G]) are required. This algorithm was first formulated in full 
generality by Boneh and Lipton in [14]. However, proper attribution of this algorithm is difficult because, as 
described in chapter 5 of [76], it subsumes many historically important quantum algorithms as special cases, 
including Simon's algorithm [108], which was the inspiration for Shor's period finding algorithm, which forms the 
core of his factoring and discrete-log algorithms. The Abelian hidden subgroup algorithm is also at the core of the 
Pell's equation, principal ideal, unit group, and class group algorithms. In certain instances, the Abelian hidden 
subgroup problem can be solved using a single query rather than order log(|G]), as shown in [30]. 


Algorithm: Non-Abelian Hidden Subgroup 

Speedup: Superpolynomial 

Description: Let G be a finitely generated group, and let H be some subgroup of G that has finitely many left cosets. 
Let f be a function on G such that for any g1,g2, f(g1)=/(g2) if and only if gl and g2 are in the same left coset of H. 
The task is to find H (i.e. find a set of generators for H) by making queries to f. This is solvable on a quantum 
computer using O(log(|G|) queries, whereas classically Q(|G]) are required [37,51]. However, this does not qualify as 
an efficient quantum algorithm because in general, it may take exponential time to process the quantum states 
obtained from these queries. Efficient quantum algorithms for the hidden subgroup problem are known for certain 
specific non-Abelian groups [81,55,72,53,9,22,56,71,57,43,44,28, 126,207,273]. A slightly outdated survey is given 
in [69]. Of particular interest are the symmetric group and the dihedral group. A solution for the symmetric group 


would solve graph isomorphism. A solution for the dihedral group would solve certain lattice problems [78]. Despite 
much effort, no polynomial-time solution for these groups is known, except in special cases [312]. However, 
Kuperberg [66] found a time 20(logNV)) algorithm for finding a hidden subgroup of the dihedral group DN. Regev 
subsequently improved this algorithm so that it uses not only subexponential time but also polynomial space [79]. A 
further improvement in the asymptotic scaling of the required number of qubits is obtained in [218]. Quantum query 
speedups (though not necessarily efficient quantum algorithms in terms of gate count) for somewhat more general 
problems of testing for isomorphisms of functions under sets of permutations are given in [311] 


Algorithm: Bernstein-Vazirani 

Speedup: Polynomial Directly, Superpolynomial Recursively 

Description: We are given an oracle whose input is n bits and whose output is one bit. Given input x€{0,1}n, the 
output is xOh, where h is the "hidden" string of bits, and © denotes the bitwise inner product modulo 2. The task 
is to find h. On a classical computer this requires n queries. As shown by Bernstein and Vazirani [11], this can be 
achieved on a quantum computer using a single query. Furthermore, one can construct recursive versions of this 
problem, called recursive Fourier sampling, such that quantum computers require exponentially fewer queries than 
classical computers [11]. See [256, 257] for related work on the ubiquity of quantum speedups from generic 
quantum circuits and [258, 270] for related work on a quantum query speedup for detecting correlations between the 
an oracle function and the Fourier transform of another. 


Algorithm: Deutsch-Jozsa 

Speedup: Exponential over P, none over BPP 

Description: We are given an oracle whose input is n bits and whose output is one bit. We are promised that out of 
the 2n possible inputs, either all of them, none of them, or half of them yield output 1. The task is to distinguish the 
balanced case (half of all inputs yield output 1) from the constant case (all or none of the inputs yield output 1). It 
was shown by Deutsch [32] that for n=/, this can be solved on a quantum computer using one query, whereas any 
deterministic classical algorithm requires two. This was historically the first well-defined quantum algorithm 
achieving a speedup over classical computation. (A related, more recent, pedagogical example is given in [259].) A 
single-query quantum algorithm for arbitrary n was developed by Deutsch and Jozsa in [33]. Although 
probabilistically easy to solve with O(/) queries, the Deutsch-Jozsa problem has exponential worst case 
deterministic query complexity classically. 


Algorithm: Formula Evaluation 

Speedup: Polynomial 

Description: A Boolean expression is called a formula if each variable is used only once. A formula corresponds to 
a circuit with no fanout, which consequently has the topology of a tree. By Reichardt's span-program formalism, it is 
now known [158] that the quantum query complexity of any formula of O(1) fanin on N variables is @(N—Y\). This 


that NAND trees on 2n variables can be evaluated on quantum computers in time O(20.5n) using a continuous-time 


quantum walk, whereas classical computers require Q(20.753n) queries. In many cases, the quantum formula- 
evaluation algorithms are efficient not only in query complexity but also in time-complexity. The span-program 
formalism also yields quantum query complexity lower bounds [149]. Although originally discovered from a 
different point of view, Grover's algorithm can be regarded as a special case of formula evaluation in which every 
gate is OR. The quantum complexity of evaluating non-boolean formulas has also been studied [29], but is not as 
fully understood. Childs et al. have generalized to the case in which input variables may be repeated (i.e. the first 
layer of the circuit may include fanout) [101]. They obtained a quantum algorithm using O(min{N,S-—V,N 1/2G1/4}) 
queries, where N is the number of input variables not including multiplicities, S is the number of inputs counting 
multiplicities, and G is the number of gates in the formula. References [164], [165], and [269] consider special cases 
of the NAND tree problem in which the number of NAND gates taking unequal inputs is limited. Some of these 


cases yield superpolynomial separation between quantum and classical query complexity. 


Algorithm: Gradients, Structured Search, and Learning Polynomials 

Speedup: Polynomial 

Description: Suppose we are given a oracle for computing some smooth function f;Rd—R. The inputs and outputs 
to fare given to the oracle with finitely many bits of precision. The task is to estimate Vf at some specified point 
x0ERd. As shown in [61], a quantum computer can achieve this using one query, whereas a classical computer 
needs at least d+/ queries. In [20], Bulger suggested potential applications for optimization problems. As shown in 
appendix D of [62], a quantum computer can use the gradient algorithm to find the minimum of a quadratic form in 
d dimensions using O(d) queries, whereas, as shown in [94], a classical computer needs at least Q(d2) queries. 


Single query quantum algorithms for finding the minima of basins based on Hamming distance were given in 
[147,148,223]. The quantum algorithm of [62] can also extract all d2 matrix elements of the quadratic form using 
O(d) queries, and more generally, all dn nth derivatives of a smooth function of d variables in O(dn—1) queries. As 
shown in [130,146], quadratic forms and multilinear polynomials in d variables over a finite field may be extracted 


with a factor of d fewer quantum queries than are required classically. 


Algorithm: Hidden Shift 

Speedup: Superpolynomial 

Description: We are given oracle access to some function fon ZN. We know that f(x) = g(x+s) where g is a known 
function and s is an unknown shift. The hidden shift problem is to find s. By reduction from Grover's problem it is 
clear that at least N-—V queries are necessary to solve hidden shift in general. However, certain special cases of the 
hidden shift problem are solvable on quantum computers using O(/) queries. In particular, van Dam et al. showed 
that this can be done if fis a multiplicative character of a finite ring or field [89]. The previously discovered shifted 
Legendre symbol algorithm [88,86] is subsumed as a special case of this, because the Legendre symbol (xp) is a 
multiplicative character of Fp. No classical algorithm running in time O(polylog()) is known for these problems. 
Furthermore, the quantum algorithm for the shifted Legendre symbol problem would break a certain cryptographic 
pseudorandom generator given the ability to make quantum queries to the generator [89]. A quantum speedup for 
hidden shift problems of difference sets is given in [312], and this also subsumes the Legendre symbol problem as a 


special case. Roetteler has found exponential quantum speedups for finding hidden shifts of certain nonlinear 
Boolean functions [105,130]. Building on this work, Gavinsky, Roetteler, and Roland have shown [142] that the 
hidden shift problem on random boolean functions f:Zn2—+Z2 has O(n) average case quantum complexity, whereas 
the classical query complexity is Q(2n/2). The results in [143], though they are phrased in terms of the hidden 


subgroup problem for the dihedral group, imply that the quantum query complexity of the hidden shift problem for 
an injective function on ZN is O(log n), whereas the classical query complexity is @(N-—V). However, the best 
known quantum circuit complexity for injective hidden shift on ZN is O(2ClogNV), achieved by Kuperberg's sieve 
algorithm [66]. 


Algorithm: Polynomial interpolation 

Speedup: Constant factor 

Description: Let p(x)=adxd+...+a1x+a0 be a polynomial over the finite field GF(g). One is given access to an 
oracle that, given xEGF(q), returns p(x). The polynomial interpolation problem is, by making queries to the oracle, 
to determine the coefficients ad,...,a0. Classically, d+1 queries are necessary and sufficient. Quantumly, d/2+1/2 
queries are necessary and d/2+1 queries are sufficient [360,361]. 


Algorithm: Pattern matching 

Speedup: Superpolynomial 

Description: Given strings T of length n and P of length m < n, both from some finite alphabet, the pattern matching 
problem is to find an occurrence of P as a substring of T or to report that P is not a substring of T. More generally, T 
and P could be d-dimensional arrays rather than one-dimensional arrays (strings). Then, the pattern matching 
problem is to return the location of P as a mxm*...xm block within the nxn...xn array T or report that no such 
location exists. The Q(N—V) query lower bound for unstructured search [216] implies that the worst-case quantum 
query complexity of this problem is Q(in—V+m——N). A quantum algorithm achieving this, up to logarithmic factors, 
was obtained in [217]. This quantum algorithm works through the use of Grover's algorithm together with a classical 
method called deterministic sampling. More recently, Montanaro showed that superpolynomial quantum speedup 
can be achieved on average case instances of pattern matching, provided that m is greater than logarithmic in n. 
Specifically, the quantum algorithm given in [215] solves average case pattern matching in 
O*((nlm)d/220(d3/2logm\)) time. This quantum algorithm is constructed by generalizing Kuperberg's quantum 
sieve algorithm [66] for dihedral hidden subgroup and hidden shift problems so that it can operate in d dimensions 
and accomodate small amounts of noise, and then classically reducing the pattern matching problem to this noisy d- 
dimensional version of hidden shift. 


Algorithm: Linear Systems 

Speedup: Superpolynomial 

Description: We are given oracle access to an nxn matrix A and some description of a vector b. We wish to find 
some property of f(A)b for some efficiently computable function f: Suppose A is a Hermitian matrix with O(polylog 
n) nonzero entries in each row and condition number k. As shown in [104], a quantum computer can in O(k2logn) 
time compute to polynomial precision various expectation values of operators with respect to the vector f(A)b 
(provided that a quantum state proportional to b is efficiently constructable). For certain functions, such as f(x)=1/x, 
this procedure can be extended to non-Hermitian and even non-square A. The runtime of this algorithm was 
subsequently improved to O(klog3klogn) in [138]. Exponentially improved scaling of runtime with precision was 
obtained in [263]. Extensions of this quantum algorithm have been applied to problems of estimating 
electromagnetic scattering crossections [249] (see also [369] for a different approach), solving linear differential 
equations [156, 296], estimating electrical resistance of networks [210], least-squares curve-fitting [169], solving 
Toeplitz systems [297], and machine learning [214,222,250,251,309]. Some limitations of the quantum machine 


learning algorithms based on linear systems are nicely summarized in [246]. In [220] it was shown that quantum 
computers can invert well-conditioned nxn matrices using only O(logn) qubits, whereas the best classical algorithm 
uses order log2n bits. Subsequent improvements to this quantum algorithm are given in [279]. 


Algorithm: Ordered Search 
Speedup: Constant factor 
Description: We are given oracle access to a list of N numbers in order from least to greatest. Given a number x, the 


task is to find out where in the list it would fit. Classically, the best possible algorithm is binary search which takes 
log2N queries. Farhi et al. showed that a quantum computer can achieve this using 0.53 log2N queries [39]. 
Currently, the best known deterministic quantum algorithm for this problem uses 0.433 log2N queries [103]. A 
lower bound of In2zlog2N quantum queries has been proven for this problem [219, 24]. In [10], a randomized 
quantum algorithm is given whose expected query complexity is less than 13log2N. 


Algorithm: Graph Properties in the Adjacency Matrix Model 

Speedup: Polynomial 

Description: Let G be a graph of n vertices. We are given access to an oracle, which given a pair of integers in 
{1,2,...,2} tells us whether the corresponding vertices are connected by an edge. Building on previous work 
[35,52,36], Diirr et al. [34] show that the quantum query complexity of finding a minimum spanning tree of 
weighted graphs, and deciding connectivity for directed and undirected graphs have ©(n3/2) quantum query 
complexity, and that finding lowest weight paths has O(n3/2log2n) quantum query complexity. Deciding whether a 
graph is bipartite, detecting cycles, and deciding whether a given vertex can be reached from another (st- 
connectivity) can all be achieved using a number of queries and quantum gates that both scale as O"(n3/2), and only 
logarithmically many qubits, as shown in [317], building upon [13, 272, 318]. A span-program-based quantum 
algorithm for detecting trees of a given size as minors in O"(n) time is given in [240]. A graph property is sparse if 
there exists a constant c such that every graph with the property has a ratio of edges to vertices at most c. Childs and 


Kothari have shown that all sparse graph properties have query complexity @(n2/3) if they cannot be characterized 
by a list of forbidden subgraphs and o0(n2/3) (little-o) if they can [140]. The former algorithm is based on Grover 
search, the latter on the quantum walk formalism of [141]. By Mader's theorem, sparse graph properties include all 
nontrivial minor-closed properties. These include planarity, being a forest, and not containing a path of given length. 
According to the widely-believed Aanderaa-Karp-Rosenberg conjecture, all of the above problems have Q(n2) 
classical query complexity. Another interesting computational problem is finding a subgraph H in a given graph G. 
The simplest case of this finding the triangle, that is, the clique of size three. The fastest known quantum algorithm 
for this finds a triangle in O(75/4) quantum queries [319], improving upon [276, 175, 171, 70, 152, 21]. Stronger 
quantum query complexity upper bounds are known when the graphs are sufficiently sparse [319, 320]. Classically, 
triangle finding requires Q(n2) queries [21]. More generally, a quantum computer can find an arbitrary subgraph of 
k vertices using O(n2—2/k—-t) queries where t=(2k—d—3)/(k(d+1)(m+2)) and d and m are such that H has a vertex of 
degree d and m+d edges [153]. This improves on the previous algorithm of [70]. In some cases, this query 
complexity is beaten by the quantum algorithm of [140], which finds H using O°(n32—1vc(H)+1) queries, provided 
G is sparse, where vc(H) is the size of the minimal vertex cover of H. A quantum algorithm for finding constant- 
sized sub-hypergraphs over 3-uniform hypergraphs in O(n1.883) queries is given in [241]. 


Algorithm: Graph Properties in the Adjacency List Model 

Speedup: Polynomial 

Description: Let G be a graph of N vertices, M edges, and degree d. We are given access to an oracle which, when 
queried with the label of a vertex and jE{1,2,...,d} outputs the jth neighbor of the vertex or null if the vertex has 
degree less than d. Suppose we are given the promise that G is either bipartite or is far from bipartite in the sense 
that a constant fraction of the edges would need to be removed to achieve bipartiteness. Then, as shown in [144], the 
quantum complexity of deciding bipartiteness is O"(N1/3). Also in [144], it is shown that distinguishing expander 
graphs from graphs that are far from being expanders has quantum complexity O"(N1/3) and Q”(N1/4), whereas the 
classical complexity is @*(N-—V). The key quantum algorithmic tool is Ambainis' algorithm for element 
distinctness. In [34], it is shown that finding a minimal spanning tree has quantum query complexity @(NM——\), 
deciding graph connectivity has quantum query complexity @(J) in the undirected case, and @-(NM-———\) in the 
directed case, and computing the lowest weight path from a given source to all other vertices on a weighted graph 
has quantum query complexity @*(NM—-—VY). In [317] quantum algorithms are given for st-connectivity, deciding 


bipartiteness, and deciding whether a graph is a forest, which run in O~(Nd-—N) time and use only logarithmically 
many qubits. 


Algorithm: Welded Tree 

Speedup: Superpolynomial 

Description: Some computational problems can be phrased in terms of the query complexity of finding one's way 
through a maze. That is, there is some graph G to which one is given oracle access. When queried with the label of a 
given node, the oracle returns a list of the labels of all adjacent nodes. The task is, starting from some source node 
(i.e. its label), to find the label of a certain marked destination node. As shown by Childs et al. [26], quantum 
computers can exponentially outperform classical computers at this task for at least some graphs. Specifically, 
consider the graph obtained by joining together two depth-n binary trees by a random "weld" such that all nodes but 
the two roots have degree three. Starting from one root, a quantum computer can find the other root using poly(n) 
queries, whereas this is provably impossible using classical queries. 


Algorithm: Collision Finding and Element Distinctness 

Speedup: Polynomial 

Description: Suppose we are given oracle access to a two to one function f on a domain of size N. The collision 
problem is to find a pair x,yE{1,2,...,N} such that f(x) = f(y). The classical randomized query complexity of this 
problem is @(N—Y), whereas, as shown by Brassard et al., a quantum computer can achieve this using O(N1/3) 
queries [18]. (See also [315].) Removing the promise that fis two-to-one yields a problem called element 
distinctness, which has @(N) classical query complexity. Improving upon [21], Ambainis gives a quantum algorithm 
with query complexity of O(N2/3) for element distinctness, which is optimal [7, 374]. The problem of deciding 
whether any k-fold collisions exist is called k-distinctness. Improving upon [7,154], the best quantum query 
complexity for k-distinctness is O(n3/4—-1/(4(2k—1))) [172, 173]. For k=2,3 this is also the time-complexity, up to 
logarithmic factors, by [7]. For k>3 the fastest known quantum algorithm has time complexity O(n(k—1)/k) [363]. 
Given two functions f and g, on domains of size N and M, respectively a claw is a pair x,y such that f(x) = g(y). In 
the case that N=M, the algorithm of [7] solves claw-finding in O(V2/3) queries, improving on the previous 
O(N3/4logN) quantum algorithm of [21]. Further work gives improved query complexity for various parameter 
regimes in which N#M [364, 365]. More generally, a related problem to element distinctness, is, given oracle access 
to a sequence, to estimate the Ath frequency moment Fk=))jnkj, where nj is the number of times that j occurs in the 


sequence. An approximately quadratic speedup for this problem is obtained in [277]. See also graph collision. 


Algorithm: Graph Collision 

Speedup: Polynomial 

Description: We are given an undirected graph of n vertices and oracle access to a labelling of the vertices by 1 and 
0. The graph collision problem is, by querying this oracle, to decide whether there exist a pair of vertices, connected 
by an edge, both of which are labelled 1. One can embed Grover's unstructured search problem as an instance of 
graph collision by choosing the star graph, labelling the center |, and labelling the remaining vertices by the 
database entries. Hence, this problem has quantum query complexity Q(n—\) and classical query complexity O(n). 
In [70], Magniez, Nayak, and Szegedy gave a O(N2/3)-query quantum algorithm for graph collision on general 
graphs. This remains the best upper bound on quantum query complexity for this problem on general graphs. 
However, stronger upper bounds have been obtained for several special classes of graphs. Specifically, the quantum 
query complexity on a graph G is O-(n—N+l) where / is the number of non-edges in G [161], O(n—Nal/6) where 
ais the size of the largest independent set of G [172], O(n—-VN+a+*——V) where a* is the maximum total degree of 
any independent set of G [200], and O(n—N11/6) where ¢ is the treewidth of G [201]. Furthermore, the quantum 
query complexity is O-(n—VN) with high probability for random graphs in which the presence or absence of an edge 
between each pair of vertices is chosen independently with fixed probability, (i.e. Erdés-Rényi graphs) [200]. See 
[201] for a summary of these results as well as new upper bounds for two additional classes of graph that are too 
complicated to describe here. 


Algorithm: Matrix Commutativity 


Speedup: Polynomial 

Description: We are given oracle access to k matrices, each of which are nxn. Given integers ijE{1,2,...,.1}, and 
x€{1,2,...,k} the oracle returns the ij matrix element of the xth matrix. The task is to decide whether all of these k 
matrices commute. As shown by Itakura [54], this can be achieved on a quantum computer using O(k4/5n9/5) 
queries, whereas classically this requires Q(kn2) queries. 


Algorithm: Group Commutativity 

Speedup: Polynomial 

Description: We are given a list of k generators for a group G and access to a blackbox implementing group 
multiplication. By querying this blackbox we wish to determine whether the group is commutative. The best known 
classical algorithm is due to Pak and requires O(k) queries. Magniez and Nayak have shown that the quantum query 
complexity of this task is @°(k2/3) [139]. 


Algorithm: Hidden Nonlinear Structures 

Speedup: Superpolynomial 

Description: Any Abelian group G can be visualized as a lattice. A subgroup H of G is a sublattice, and the cosets 
of H are all the shifts of that sublattice. The Abelian hidden subgroup problem is normally solved by obtaining 
superposition over a random coset of the Hidden subgroup, and then taking the Fourier transform so as to sample 
from the dual lattice. Rather than generalizing to non-Abelian groups (see non-Abelian hidden subgroup), one can 
instead generalize to the problem of identifying hidden subsets other than lattices. As shown by Childs et al. [23] 
this problem is efficiently solvable on quantum computers for certain subsets defined by polynomials, such as 
spheres. Decker et al. showed how to efficiently solve some related problems in [31, 212]. 


Algorithm: Center of Radial Function 

Speedup: Polynomial 

Description: We are given an oracle that evaluates a function f from Rd to some arbitrary set S, where fis 
spherically symmetric. We wish to locate the center of symmetry, up to some precision. (For simplicity, let the 
precision be fixed.) In [110], Liu gives a quantum algorithm, based on a curvelet transform, that solves this problem 


using a constant number of quantum queries independent of d. This constitutes a polynomial speedup over the 
classical lower bound, which is Q(d) queries. The algorithm works when the function f fluctuates on sufficiently 
small scales, e.g., when the level sets of fare sufficiently thin spherical shells. The quantum algorithm is shown to 
work in an idealized continuous model, and nonrigorous arguments suggest that discretization effects should be 
small. 


Algorithm: Group Order and Membership 

Speedup: Superpolynomial 

Description: Suppose a finite group G is given oracularly in the following way. To every element in G, one assigns 
a corresponding label. Given an ordered pair of labels of group elements, the oracle returns the label of their 
product. There are several classically hard problems regarding such groups. One is to find the group's order, given 
the labels of a set of generators. Another task is, given a bitstring, to decide whether it corresponds to a group 
element. The constructive version of this membership problem requires, in the yes case, a decomposition of the 
given element as a product of group generators. Classically, these problems cannot be solved using polylog(|G]) 
queries even if G is Abelian. For Abelian groups, quantum computers can solve these problems using polylog(|G]) 
queries by reduction to the Abelian hidden subgroup problem, as shown by Mosca [74]. Furthermore, as shown by 
Watrous [91], quantum computers can solve these problems using polylog(|G|) queries for any solvable group. For 
groups given as matrices over a finite field rather than oracularly, the order finding and constructive membership 
problems can be solved in polynomial time by using the quantum algorithms for discrete log and factoring [124]. 
See also group isomorphism. 


Algorithm: Group Isomorphism 

Speedup: Superpolynomial 

Description: Let G be a finite group. To every element of G is assigned an arbitrary label (bit string). Given an 
ordered pair of labels of group elements, the group oracle returns the label of their product. Given access to the 
group oracles for two groups G and G’, and a list of generators for each group, we must decide whether G and G’ are 
isomorphic. For Abelian groups, we can solve this problem using poly(log |G}, log |G'|) queries to the oracle by 
applying the quantum algorithm of [127], which decomposes any Abelian group into a canonical direct product of 
cyclic groups. The quantum algorithm of [128] solves the group isomorphism problem using poly(log |G], log |G'|) 
queries for a certain class of non-Abelian groups. Specifically, a group G is in this class if G has a normal Abelian 
subgroup A and an element y of order coprime to |A| such that G = A, y. Zatloukal has recently given an exponential 
quantum speedup for some instances of a problem closely related to group isomorphism, namely testing equivalence 
of group extensions [202]. 


Algorithm: Statistical Difference 

Speedup: Polynomial 

Description: Suppose we are given two black boxes A and B whose domain is the integers | through T and whose 
range is the integers | through N. By choosing uniformly at random among allowed inputs we obtain a probability 
distribution over the possible outputs. We wish to approximate to constant precision the L1 distance between the 
probability distributions determined by A and B. Classically the number of necessary queries scales essentially 
linearly with N. As shown in [117], a quantum computer can achieve this using O(N--V) queries. Approximate 
uniformity and orthogonality of probability distributions can also be decided on a quantum computer using O(N1/3) 
queries. The main tool is the quantum counting algorithm of [16]. A further improved quantum algorithm for this 
task is obtained in [265]. 


Algorithm: Finite Rings and Ideals 

Speedup: Superpolynomial 

Description: Suppose we are given black boxes implementing the addition and multiplication operations on a finite 
ring R, not necessarily commutative, along with a set of generators for R. With respect to addition, R forms a finite 
Abelian group (R,+). As shown in [119], on a quantum computer one can find in poly(log |R]) time a set of additive 
generators {/1,...,4m}CR such that (R,+)=(h1)x...x(AM) and m is polylogarithmic in |R|. This allows efficient 
computation of a multiplication tensor for R. As shown in [118], one can similarly find an additive generating set for 
any ideal in R. This allows one to find the intersection of two ideals, find their quotient, prove whether a given ring 
element belongs to a given ideal, prove whether a given element is a unit and if so find its inverse, find the additive 
and multiplicative identities, compute the order of an ideal, solve linear equations over rings, decide whether an 
ideal is maximal, find annihilators, and test the injectivity and surjectivity of ring homomorphisms. As shown in 
[120], one can also use a quantum computer to efficiently decide whether a given polynomial is identically zero on a 
given finite black box ring. Known classical algorithms for these problems scale as poly(|R)). 


Algorithm: Counterfeit Coins 

Speedup: Polynomial 

Description: Suppose we are given N coins, k of which are counterfeit. The real coins are all of equal weight, and 
the counterfeit coins are all of some other equal weight. We have a pan balance and can compare the weight of any 
pair of subsets of the coins. Classically, we need O(klog(N/k)) weighings to identify all of the counterfeit coins. We 
can introduce an oracle such that given a pair of subsets of the coins of equal cardinality, it outputs one bit indicating 
balanced or unbalanced. Building on previous work by Terhal and Smolin [137], Iwama et al. have shown [136] that 
on a quantum computer, one can identify all of the counterfeit coins using O(k1/4) queries. The core techniques 
behind the quantum speedup are amplitude amplification and the Bernstein-Vazirani algorithm. 


Algorithm: Matrix Rank 


Speedup: Polynomial 

Description: Suppose we are given oracle access to the (integer) entries of an nxm matrix A. We wish to determine 
the rank of the matrix. Classically this requires order nm queries. Building on [149], Belovs [150] gives a quantum 
algorithm that can use fewer queries given a promise that the rank of the matrix is at least r. Specifically, Belovs' 
algorithm uses O(r(n—r+1) \LT) queries, where L is the root-mean-square of the reciprocals of the r 
largest singular values of A and T is a factor that depends on the sparsity of the matrix. For general A, 
T=O(nm-—-\). If A has at most k nonzero entries in any row or column then T=O(klog(n+m)). (To achieve the 
corresponding query complexity in the k-sparse case, the oracle must take a column index as input, and provide a list 


of the nonzero matrix elements from that column as output.) As an important special case, one can use these 
quantum algorithms for the problem of determining whether a square matrix is singular, which is sometimes referred 
to as the determinant problem. For general A the quantum query complexity of the determinant problem is no lower 
than the classical query complexity [151]. However, [151] does not rule out a quantum speedup given a promise on 
A, such as sparseness or lack of small singular values. 


Algorithm: Matrix Multiplication over Semirings 

Speedup: Polynomial 

Description: A semiring is a set endowed with addition and multiplication operations that obey all the axioms of a 
ring except the existence additive inverses. Matrix multiplication over various semirings has many applications to 
graph problems. Matrix multiplication over semirings can be sped up by straightforward Grover improvements upon 
schoolbook multiplication, yielding a quantum algorithm that multiplies a pair of nxn matrices in O"(n5/2) time. For 
some semirings this algorithm outperforms the fastest known classical algorithms and for some semirings it does not 
[206]. A case of particular interest is the Boolean semiring, in which OR serves as addition and AND serves as 
multiplication. No quantum algorithm is known for Boolean semiring matrix multiplication in the general case that 
beats the best classical algorithm, which has complexity n2.373. However, for sparse input our output, quantum 
speedups are known. Specifically, let A,B be n by n Boolean matrices. Let C=AB, and let / be the number of entries 
of C that are equal to | (i.e. TRUE). Improving upon [19, 155, 157], the best known upper bound on quantum query 
complexity is O*(nl\), as shown in [161]. If instead the input matrices are sparse, a quantum speedup over the fastest 
known classical algorithm also has been found in a certain regime [206]. For detailed comparison to classical 
algorithms, see [155, 206]. Quantum algorithms have been found to perform matrix multiplication over the 
(max,min) semiring in O(n2.473) time and over the distance dominance semiring in O"(n2.458) time [206]. The 
fastest known classical algorithm for both of these problems has O~(n2.687) complexity. 


Algorithm: Subset finding 

Speedup: Polynomial 

Description: We are oracle access to a function f:D—>R where D and R are finite sets. Some property PC(DxR)k is 
specified, for example as an explicit list. Our task is to find a size-k subset of D satisfying P, i.e. 

((x1 f(x1)),...,(xk f(xk)))EP, or reject if none exists. As usual, we wish to do this with the minimum number of 
queries to f. Generalizing the result of [7], it was shown in [162] that this can be achieved using O(|D|k/(k+1)) 
quantum queries. As an noteworthy special case, this algorithm solves the k-subset-sum problem of finding k 
numbers from a list with some desired sum. A matching lower bound for the quantum query complexity is proven in 
[163]. 


Algorithm: Search with Wildcards 

Speedup: Polynomial 

Description: The search with wildcards problem is to identify a hidden n-bit string x by making queries to an oracle 
f. Given SE{1,2,...,2} and yE{0,1}|S|, freturns one if the substring of x specified by S is equal to y, and returns zero 
otherwise. Classically, this problem has query complexity O(n). As shown in [167], the quantum query complexity 
of this problem is @(n—V). Interestingly, this quadratic speedup is achieved not through amplitude amplification or 
quantum walks, but rather through use of the so-called Pretty Good Measurement. The paper [167] also gives a 


quantum speedup for the related problem of combinatorial group testing. This result and subsequent faster quantum 
algorithms for group testing are discussed in the entry on Junta Testing and Group Testing. 


Algorithm: Network flows 

Speedup: Polynomial 

Description: A network is a directed graph whose edges are labeled with numbers indicating their carrying 
capacities, and two of whose vertices are designated as the source and the sink. A flow on a network is an 
assignment of flows to the edges such that no flow exceeds that edge's capacity, and for each vertex other than the 
source and sink, the total inflow is equal to the total outflow. The network flow problem is, given a network, to find 
the flow that maximizes the total flow going from source to sink. For a network with n vertices, m edges, and integer 
capacities of maximum magnitude U, [168] gives a quantum algorithm to find the maximal flow in time 
O(min{n7/6m—NV U 1/3,nU-—-\m} xlogn). The network flow problem is closely related to the problem of finding a 
maximal matching of a graph, that is, a maximal-size subset of edges that connects each vertex to at most one other 
vertex. The paper [168] gives algorithms for finding maximal matchings that run in time O(nm+n————\logn) if the 
graph is bipartite, and O(n2(m/n———V +logn)logn) in the general case. The core of these algorithms is Grover 
search. The known upper bounds on classical complexity of the network flow and matching problems are 
complicated to state because different classical algorithms are preferable in different parameter regimes. However, 
in certain regimes, the above quantum algorithms beat all known classical algorithms. (See [168] for details.) 


Algorithm: Electrical Resistance 

Speedup: Exponential 

Description: We are given oracle access to a weighted graph of n vertices and maximum degree d whose edge 
weights are to be interpreted as electrical resistances. Our task is to compute the resistance between a chosen pair of 
vertices. Wang gave two quantum algorithms in [210] for this task that run in time poly(logn,d,1/¢,1/e), where ¢ is 
the expansion of the graph, and the answer is to be given to within a factor of 1+€. Known classical algorithms for 
this problem are polynomial in n rather than logn. One of Wang's algorithms is based on a novel use of quantum 
walks. The other is based on the quantum algorithm of [104] for solving linear systems of equations. The first 
quantum query complexity upper bounds for the electrical resistance problem in the adjacency query model are 
given in [280] using approximate span programs. 


Algorithm: Machine Learning 

Speedup: Varies 

Description: Maching learning encompasses a wide variety of computational problems and can be attacked by a 
wide variety of algorithmic techniques. This entry summarizes quantum algorithmic techniques for improved 
machine learning. Many of the quantum algorithms here are cross-listed under other headings. In 
[214,222,250,251,309,338,339,359], quantum algorithms for solving linear systems [104] are applied to speed up 
cluster-finding, principal component analysis, binary classification, and various forms of regression, provided the 
data satisfies certain conditions. In [222], these quantum algorithms for linear systems are applied to speed up the 


characterization of persistent homology from data sets. A cluster-finding method not based on the linear systems 
algorithm of [104] is given in [336]. The papers [192,195,344,345,346,347,348] explore the use of adiabatic 
optimization techniques to speed up the training of classifiers. In [221], a method is proposed for training Boltzmann 
machines by manipulating coherent quantum states with amplitudes proportional to the Boltzmann weights. 
Polynomial speedups can be obtained by applying Grover search and related techniques such as amplitude 
amplification to amenable subroutines of state of the art classical machine learning algorithms. See, for example 
[358,340,341,342,343]. Other quantum machine learning algorithms not falling into one of the above categories 
include [337,349]. Some limitations of quantum machine learning algorithms are nicely summarized in [246]. Many 
other quantum query algorithms that extract hidden structure of the black-box function could be cast as machine 
learning algorithms. See for example [146,23,11,31,212]. Query algorithms for learning the majority and 


"pattleship" functions are given in [224]. Large quantum advantages for learning from noisy oracles are given in 


[236,237]. Several recent review articles [299,332,333] and a book [331] are available which summarize the state of 
the field. There is a related body of work, not strictly within the standard setting of quantum algorithms, regarding 
quantum learning in the case that the data itself is quantum coherent. See e.g. 
[350,334,335,351,352,353,354,355,356,357]. 


Algorithm: Junta Testing and Group Testing 

Speedup: Polynomial 

Description: A function f: {0,1 }n— {0,1} is a k-junta if it depends on at most k of its input bits. The k-junta testing 
problem is to decide whether a given function is a k-junta or is €-far from any k-junta. Althoug it is not obvious, this 
problem is closely related to group testing. A group testing problem is defined by a function f-{1,2,...,n}— {0,1}. 
One is given oracle access to F, which takes as input subsets of {1,2,...,1}. F(S) = 1 if there exists xES such that f(x) 
= | and F(S) = 0 otherwise. In [266] a quantum algorithm is given solving the k-junta problem using O™(kle-——N) 
queries and O*(nk/e-—V) time. This is a quadratic speedup over the classical complexity, and improves upon a 
previous quantum algorithm for k-junta testing given in [267]. A polynomial speedup for a gapped (i.e. 
approximation) version of group testing is also given in [266], improving upon the earlier results of [167,268]. 


Approximation and Simulation Algorithms 

Algorithm: Quantum Simulation 

Speedup: Superpolynomial 

Description: It is believed that for any physically realistic Hamiltonian H on n degrees of freedom, the 
corresponding time evolution operator e—iHt can be implemented using poly(n,t) gates. Unless BPP=BQP, this 
problem is not solvable in general on a classical computer in polynomial time. Many techniques for quantum 
simulation have been developed for general classes of Hamiltonians 

[25,95,92,5,12,170,205,211,244,245 278,293,294 295,372,382], chemical dynamics [63,68,227,310,375], condensed 
matter physics [1,99, 145], relativistic quantum mechanics (the Dirac and Klein-Gordon equations) 
[367,369,370,371], open quantum systems [376, 377,378,379], and quantum field theory 
[107,166,228,229,230,368]. The exponential complexity of classically simulating quantum systems led Feynman to 
first propose that quantum computers might outperform classical computers on certain tasks [40]. Although the 
problem of finding ground energies of local Hamiltonians is QMA-complete and therefore probably requires 
exponential time on a quantum computer in the worst case, quantum algorithms have been developed to approximate 
ground [102,231,232,233,234,235,308,321,322,380,381] and thermal [132,121,281,282,307] states for some classes 
of Hamiltonians. Efficient quantum algorithms have been also obtained for preparing certain classes of tensor 
network states [323,324,325,326,327,328]. 


Algorithm: Knot Invariants 

Speedup: Superpolynomial 

Description: As shown by Freedman [42, 41], et al., finding a certain additive approximation to the Jones 
polynomial of the plat closure of a braid at ei27/5 is a BQP-complete problem. This result was reformulated and 
extended to ei2z/k for arbitrary k by Aharonov et al. [4,2]. Wocjan and Yard further generalized this, obtaining a 
quantum algorithm to estimate the HOMFLY polynomial [93], of which the Jones polynomial is a special case. 
Aharonov et al. subsequently showed that quantum computers can in polynomial time estimate a certain additive 
approximation to the even more general Tutte polynomial for planar graphs [3]. It is not fully understood for what 
range of parameters the approximation obtained in [3] is BQP-hard. (See also partition functions.) Polynomial-time 
quantum algorithms have also been discovered for additively approximating link invariants arising from quantum 
doubles of finite groups [174]. (This problem is not known to be BQP-hard.) As shown in [83], the problem of 
finding a certain additive approximation to the Jones polynomial of the trace closure of a braid at ei27/5 is DQCI- 


complete. 


Algorithm: Three-manifold Invariants 

Speedup: Superpolynomial 

Description: The Turaev-Viro invariant is a function that takes three-dimensional manifolds as input and produces a 
real number as output. Homeomorphic manifolds yield the same number. Given a three-manifold specified by a 
Heegaard splitting, a quantum computer can efficiently find a certain additive approximation to its Turaev-Viro 
invariant, and this approximation is BQP-complete [129]. Earlier, in [114], a polynomial-time quantum algorithm 
was given to additively approximate the Witten-Reshitikhin-Turaev (WRT) invariant of a manifold given by a 


surgery presentation. Squaring the WRT invariant yields the Turaev-Viro invariant. However, it is unknown whether 
the approximation achieved in [114] is BQP-complete. A suggestion of a possible link between quantum 
computation and three-manifold invariants was also given in [115]. 


Algorithm: Partition Functions 

Speedup: Superpolynomial 

Description: For a classical system with a finite set of states S the partition function is Z=)\s€Se—E(s)/kT, where T 
is the temperature and k is Boltzmann's constant. Essentially every thermodynamic quantity can be calculated by 
taking an appropriate partial derivative of the partition function. The partition function of the Potts model is a special 
case of the Tutte polynomial. A quantum algorithm for approximating the Tutte polynomial is given in [3]. Some 
connections between these approaches are discussed in [67]. Additional algorithms for estimating partition functions 
on quantum computers are given in [112,113,45,47]. A BQP-completeness result (where the "energies" are allowed 
to be complex) is also given in [113]. A method for approximating partition functions by simulating thermalization 


processes is given in [121]. A quadratic speedup for the approximation of general partition functions is given in 
[122]. A method based on quantum walks, achieving polynomial speedup for evaluating partition functions is given 
in [265]. 


Algorithm: Adiabatic Algorithms 

Speedup: Unknown 

Description: In adiabatic quantum computation one starts with an initial Hamiltonian whose ground state is easy to 
prepare, and slowly varies the Hamiltonian to one whose ground state encodes the solution to some computational 
problem. By the adiabatic theorem, the system will track the instantaneous ground state provided the variation of the 
Hamiltonian is sufficiently slow. The runtime of an adiabatic algorithm scales at worst as 1/y3 where y is the 
minimum eigenvalue gap between the ground state and the first excited state [185]. If the Hamiltonian is varied 
sufficiently smoothly, one can improve this to O*(1/y2) [247]. Adiabatic quantum computation was first proposed by 
Farhi et al. as a method for solving NP-complete combinatorial optimization problems [96, 186]. Adiabatic quantum 


algorithms for optimization problems typically use "stoquastic" Hamiltonians, which do not suffer from the sign 
problem. Such algorithms are sometimes referred to as quantum annealing. Adiabatic quantum computation with 
non-stoquastic Hamiltonians is as powerful as the quantum circuit model [97]. Adiabatic algorithms using stoquastic 
Hamiltonians are probably less powerful [183], but may be nevertheless more powerful than classical computation. 
The asymptotic runtime of adiabatic optimization algorithms is notoriously difficult to analyze, but some progress 
has been achieved [179,180,181,182,187,188,189,190,191,226]. (Also relevant is an earlier literature on quantum 
annealing, which originally referred to a classical optimization algorithm that works by simulating a quantum 


process, much as simulated annealing is a classical optimization algorithm that works by simulating a thermal 
process. See e.g. [199, 198].) Adiabatic quantum computers can perform a process somewhat analogous to Grover 
search in O(N—V) time [98]. Adiabatic quantum algorithms achieving quadratic speedup for a more general class of 
problems are constructed in [184] by adapting techniques from [85]. Adiabatic quantum algorithms have been 
proposed for several specific problems, including PageRank [176], machine learning [192, 195], and graph problems 
[193, 194]. Some quantum simulation algorithms also use adiabatic state preparation. 


Algorithm: Quantum Approximate Optimization 


Speedup: Superpolynomial 

Description: For many combinatorial optimization problems, finding the exact optimal solution is NP-complete. 
There are also hardness-of-approximation results proving that finding an approximation with sufficiently small error 
bound is NP-complete. For certain problems there is a gap between the best error bound achieved by a polynomial- 
time classical approximation algorithm and the error bound proven to be NP-hard. In this regime there is potential 
for exponential speedup by quantum computation. In [242] a new quantum algorithmic technique called the 
Quantum Approximate Optimization Algorithm (QAOA) was proposed for finding approximate solutions to 
combinatorial optimization problems. In [243] it was subsequently shown that QAOA solves a combinatorial 
optimization problem called Max E3LIN2 with a better approximation ratio than any polynomial-time classical 
algorithm known at the time. However, an efficient classical algorithm achieving an even better approximation ratio 
(in fact, the approximation ratio saturating the limit set by hardness-of-approximation) was subsequently discovered 
[260]. Presently, the power of QAOA relative to classical computing is an active area of research [300, 301, 302, 
314). 


Algorithm: Semidefinite Programming 

Speedup: Superpolynomial 

Description: Given a list of m + 1 Hermitian nxn matrices C,A1,A2,...,Am and m numbers b1,...,bm, the problem of 
semidefinite programming is to find the positive semidefinite nxn matrix X that maximizes tr(CX) subject to the 
constraints tr(AjX)<bj for j=1,2,...,m. Semidefinite programming has many applications in operations research, 
combinatorial optimization, and quantum information, and it includes linear programming as a special case. 
Improving upon [313], a quantum algorithm is given in [383] that approximately solves semidefinite programs to 
within +e in time O-(m—Vlogm-poly(logn,r,<-1)), where r is the rank of the semidefinite program. This constitutes 
a quadratic speedup over the fastest classical algorithms when r is small compared to n. The quantum algorithm is 
based on amplitude amplification and quantum Gibbs sampling [121, 307]. 


Algorithm: Zeta Functions 

Speedup: Superpolynomial 

Description: Let f(x,y) be a degree-d polynomial over a finite field Fp. Let Nr be the number of projective solutions 
to f(x,y = 0 over the extension field Fpr. The zeta function for fis defined to be Z/f(T)=exp().or=1 NrrTr). 
Remarkably, Zf(T) always has the form Z/(T)=Qf(T)(1—pT)(1—-T) where Qf{T) is a polynomial of degree 2g and 
g=12(d—1)(d-2) is called the genus of f Given Zf(T) one can easily compute the number of zeros of f over any 
extension field Fpr. One can similarly define the zeta function when the original field over which fis defined does 
not have prime order. As shown by Kedlaya [64], quantum computers can determine the zeta function of a genus g 
curve over a finite field Fpr in poly(logp,r,g) time. The fastest known classical algorithms are all exponential in 
either log(p) or g. In a diffent, but somewhat related contex, van Dam has conjectured that due to a connection 
between the zeros of Riemann zeta functions and the eigenvalues of certain quantum operators, quantum computers 
might be able to efficiently approximate the number of solutions to equations over finite fields [87]. 


Algorithm: Weight Enumerators 

Speedup: Superpolynomial 

Description: Let C be a code on n bits, i.e. a subset of Zn2. The weight enumerator of C is SC(x,y)=y.c€Cx|clyn—|c| 
where |c| denotes the Hamming weight of c. Weight enumerators have many uses in the study of classical codes. If C 
is a linear code, it can be defined by C={c:Ac=0} where A is a matrix over Z2 In this case 
SC(x,y)=>.c:Ac=0x|clyn—|c|. Quadratically signed weight enumerators (QWGTs) are a generalization of this: 
S(A,B,x,y)=>,c:Ac=0(— 1)cTBcx|clyn—|c|. Now consider the following special case. Let A be an nxn matrix over Z2 
such that diag(A)=I. Let lwtr(A) be the lower triangular matrix resulting from setting all entries above the diagonal in 
A to zero. Let 1k be positive integers. Given the promise that |S(A,lwtr(A),k,J)|2=12(k2+/2)n/2 the problem of 
determining the sign of S(A,lwtr(A),k,J) is BQP-complete, as shown by Knill and Laflamme in [65]. The evaluation 
of QWGTSs is also closely related to the evaluation of Ising and Potts model partition functions [67,45,46]. 


Algorithm: Simulated Annealing 

Speedup: Polynomial 

Description: In simulated annealing, one has a series of Markov chains defined by stochastic matrices 
M1,M2,...,Mn. These are slowly varying in the sense that their limiting distributions pil,z2,...,2n satisfy |zt+1—zt|<e 
for some small ¢. These distributions can often be thought of as thermal distributions at successively lower 
temperatures. If z1 can be easily prepared, then by applying this series of Markov chains one can sample from zn. 
Typically, one wishes for zn to be a distribution over good solutions to some optimization problem. Let di be the gap 
between the largest and second largest eigenvalues of Mi. Let 6=minidi. The run time of this classical algorithm is 
proportional to 1/6. Building upon results of Szegedy [135,85], Somma et al. have shown [84, 177] that quantum 
computers can sample from zn with a runtime proportional to 1/5V. Additional methods by which classical Markov 
chain Monte Carlo algorithms can be sped up using quantum walks are given in [265]. 


Algorithm: String Rewriting 

Speedup: Superpolynomial 

Description: String rewriting is a fairly general model of computation. String rewriting systems (sometimes called 
grammars) are specified by a list of rules by which certain substrings are allowed to be replaced by certain other 
substrings. For example, context free grammars, are equivalent to the pushdown automata. In [59], Janzing and 
Wocjan showed that a certain string rewriting problem is PromiseBQP-complete. Thus quantum computers can 
solve it in polynomial time, but classical computers probably cannot. Given three strings s,7,t', and a set of string 
rewriting rules satisfying certain promises, the problem is to find a certain approximation to the difference between 
the number of ways of obtaining ¢ from s and the number of ways of obtaining ft’ from s. Similarly, certain problems 
of approximating the difference in number of paths between pairs of vertices in a graph, and difference in transition 
probabilities between pairs of states in a random walk are also BQP-complete [58]. 


Algorithm: Matrix Powers 

Speedup: Superpolynomial 

Description: Quantum computers have an exponential advantage in approximating matrix elements of powers of 
exponentially large sparse matrices. Suppose we are have an NxN symmetric matrix A such that there are at most 
polylog(N) nonzero entries in each row, and given a row index, the set of nonzero entries can be efficiently 
computed. The task is, for any | < i < N, and any m polylogarithmic in N, to approximate (Am)ii the ith diagonal 
matrix element of Am. The approximation is additive to within bme where b is a given upper bound on |A| and « is of 
order 1/polylog(4). As shown by Janzing and Wocjan, this problem is PromiseBQP-complete, as is the 
corresponding problem for off-diagonal matrix elements [60]. Thus, quantum computers can solve it in polynomial 
time, but classical computers probably cannot. 
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